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Preface 


The 10th Annual ASIACRYPT 2004 was held in Jeju Island, Korea, dur- 
ing December 5-9, 2004. This conference was organized by the International 
Association for Cryptologic Research (IACR) in cooperation with KIISC (Ko- 
rean Institute of Information Security and Cryptology) and IRIS (International 
Research center for Information Security) at ICU (Information and Communica- 
tions University) , and was financially supported by MIC (Ministry of Information 
and Communication) in Korea. 

The conference received, from 30 countries, 208 submissions that represent 
the current state of work in the cryptographic community worldwide, covering 
all areas of cryptologic research. Each paper, without the authors’ information, 
was reviewed by at least three members of the program committee, and the 
papers (co-)authored by members of the program committee were reviewed by 
at least six members. We also blinded the reviewers’ names among the reviewers 
until the final decision, by using pseudonyms. The reviews were then followed 
by deep discussions on the papers, which greatly contributed to the quality of 
the final selection. In most cases, extensive comments were sent to the authors. 

Among 208 submissions, the program committee selected 36 papers. Two 
submissions were merged into a single paper, yielding the total of 35 papers 
accepted for presentation in the technical program of the conference. Many high- 
quality works could not be accepted because of the competitive nature of the 
conference and the challenging task of selecting a program. These proceedings 
contain revised versions of the accepted papers. These revisions have not been 
checked for correctness, and the authors bear full responsibility for the contents 
of their papers. 

This was the first year in which the program committee selected a recipient 
for the Best Paper Award for the ASIACRYPT conference after lengthy dis- 
cussion on its procedure and voting among program committee members. The 
winner of the prize for the Best Paper was Claus Diem from the University of 
Essen for his paper “The XL-algorithm and a Conjecture from Commutative 
Algebra.” 

The conference program included two invited lectures. Adi Shamir, from 
the Weizmann Institute of Science, Israel, talked on “Stream Ciphers: Dead or 
Alive?,” and Ho-Ick Suk, the Deputy Minister for Informatization Planning at 
MIC of Korea, talked on “Information Security in Korea IT839 Strategy.” In 
addition, the conference also included one rump session, chaired by Moti Yung, 
which featured short informal talks. 

I wish to thank the program committee, whose members worked very hard 
over several months. I am also very grateful to the external referees who con- 
tributed with their special expertise to the selection process. Their work is highly 
appreciated. 

The submission of all papers was received electronically using Web-based 
submission software which was provided by Chanathip Namprempre with modi- 
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fications by Andre Adelsbach. During the review process, the program committee 
was mainly communicated using the Web-based review software developed by 
Bart Preneel, Wim Moreau, and Joris Claessens. 

It is my pleasure to thank the General Chair, Prof. Kwangjo Kim, for all his 
work in organizing the conference, and for the pleasant collaboration and various 
pieces of advice. In addition, I would like to extend my gratitude to the members 
of the local organizing committee. For financial support of the conference, the 
organizing committee and I gratefully acknowledge the Ministry of Information 
and Communication (MIC) of Korea. 

I am also grateful to the secretariat of the program committee. Special 
thanks to Sung Ho Yoo and Young Tae Youn for maintaining both the submis- 
sion server and the review server, and to Yong Ho Hwang and Yeon Hyeong 
Yang who served as technical assistants to the chairs and helped me with the 
various technical aspects of running the committee and preparing the conference 
proceedings, and to others for miscellaneous jobs. 

Finally, we would like to thank all the other people who provided any as- 
sistance, and all the authors who submitted their papers to ASIACRYPT 2004, 
as well as all the participants from all over the world. 


December 2004 Pil Joong Lee 
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Mappings Across Multiple Rounds 
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Abstract. We study a recently proposed design approach of Feistel ci- 
phers which employs optimal diffusion mappings across multiple rounds. 
This idea was proposed by Shirai and Shibutani at FSE2004, and the 
technique enables to improve the immunity against either differential 
or linear cryptanalysis (but not both). In this paper, we present a the- 
oretical explanation why the new design using three different matrices 
achieves the better immunity. In addition, we are able to prove conditions 
to improve the immunity against both differential and linear cryptanal- 
ysis. As a result, we show that this design approach guarantees at least 
J?(m+1) active S-boxes in 3R consecutive rounds (Ji > 2) where m is the 
number of S-boxes in a round. By using the guaranteed number of active 
S-boxes, we compare this design approach to other well-known designs 
employed in SHARK, Rijndael, and MDS-Feistel ciphers. Moreover, we 
show interesting additional properties of the new design approach. 

Keywords: optimal diffusion mapping, Feistel cipher, active S-boxes, 
MDS. 


1 Introduction 

A Feistel structure is one of the most widely used and best studied structures 
for the design of block ciphers. It was first proposed by H. Feistel in 1973; 
subsequently the structure was adopted in the well-known block cipher DES |5I6] . 
The main advantage of the Feistel structure is its involution property, which 
provides flexible designs of the underlying F-functions. During the 30 year history 
of modern block ciphers, extensive studies have been made on Feistel structure [HI 
nniH] . Currently, many well-known block ciphers, e.g. Camellia [I] , Misty m, 
RC6 [T3], Twofish [T5] , employed the design of Feistel structures. 

Recently, Shirai and Shibutani proposed a novel design approach of Feistel 
ciphers based on the concept of optimal diffusion mappings [18]. An optimal dif- 
fusion is a linear function with maximum branch number; the concept of optimal 
diffusion is used in the design of AES and many other cryptographic primitives [U 


* A guest researcher at ESAT/SCD-COSIC, K.U. Leuven from 2003 to 2004. 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 3329, pp. ljl5] 2004. 
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H5lH2l l4]. From their empirical analytic results, the immunity against either dif- 
ferential and linear cryptanalysis (but not both) would be strengthened signifi- 
cantly if the linear diffusion layer of the Feistel structure satisfies special optimal 
diffusion conditions across multiple rounds. In this way difference cancellation in 
the Feistel structure caused by a small number of active S-boxes will not occur. 
This result opened a new line of research on the Feistel structure. A theoretical 
proof of the effectiveness of the proposed design and a solution to improve the 
immunity against both differential and linear cryptanalysis remained unsolved. 

In this paper, we will call the “Optimal Diffusion Mappings across Multi- 
ple Rounds” design approach of Feistel ciphers the ODM-MR design. Our con- 
tribution is that we first give a theoretical explanation of the effectiveness of 
the ODM-MR design implied by Shirai and Shibutani. Second, we found new 
conditions and proofs to improve the immunity of both differential and linear 
cryptanalysis. Let m be the number of S-boxes in an F-function. As a result, 
by combining previous and novel conditions, we finally show that Feistel ciphers 
with the ODM-MR design guarantees i?(m + l) active S-boxes in 3 R consecutive 
rounds for R > 2. 

In order to further investigate the properties of the ODM-MR design, we 
compare the ratio of guaranteed active S-boxes to all employed S-boxes of the 
ODM-MR design to other design approaches employed in MDS-Feistel, SHARK 
and AES/Rijndael. All of them use optimal diffusion mappings in their linear 
diffusion. Consequently, in 128-bit block and 8-bit S-box settings, we obtain a 
limit of 0.371 for the active S-box ratio of ODM-MR design when the number 
r of rounds goes to infinity, which means that we can guarantee 37.1% active 
S-boxes with this design strategy. This result is apparently better than MDS- 
Feistel’s ratio of 0.313. Moreover we show that for the number of S-boxes in an 
F-function and the round number go to infinity, the converged ratio of ODM- 
MR is 0.333. This is better than Rijndael-type diffusion layer’s ratio 0.250. From 
these limit values, we can conclude that ODM-MR performs better than the other 
approaches in certain settings. 

This paper is organized as follows: in Sect. 2, we introduce some definitions 
used in this paper. Previous works including ODM-MR design approach are 
shown in Sect. 3. We prove in Sect. 4 the theorems regarding ODM-MR as our 
main contribution. In Sect. 5, we discuss the new design by presenting some 
numerical values. Finally Sect. 6 concludes the paper. The method to construct 
the concrete Feistel ciphers with ODM-MR design is proposed in Appendix A. 


2 Preliminaries 

In this paper, we treat the typical Feistel structure, which is called a balanced 
Feistel structure. It is defined as follows El- 

Definition 1. (Balanced Feistel Structure) 

Let E : (0, l} 6 X {0, l} fe — ► {0, l} 6 be a b-bit block cipher (for b even) with a k-bit 
key. Let r be the number of rounds, ki £ {0, l} fe be the k'-bit round key provided 
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by a key scheduling algorithm and Xi £ {0, l} 6 / 2 be intermediate data, and let 
Fi : {0, l} k ' x {0, l } 6 / 2 — ► {0, l } 6 / 2 be the F-function of the i-th round. The 


encryption and decryption algorithm 
as follows 

Algorithm Feistel. Encrypt k(P) 
input P £ {0,1} 6 , K £ (0, l} fc 
x 0 <- msb b/2 (P), x 1 4- lsb b/2 (P) 

for i = 1 to r do 

aif+i = Fi(ki,Xi ) ® Xi—i 

msb b/2 (C) 4- x r+1 , lsb b/2 (C) <- x r 

return C £ {0, l} 6 

where msb x (y) (lsb x {y)) represents 


of a balanced Feistel Cipher E are defined 


Algorithm Feistel.DecryptxiC) 
input C £ {0,1} 6 , K £ {0, l} fe 
x 0 <— msb b/2 (C), xi i- lsb b/2 (C) 

for i = 1 to r do 

Xi + 1 = Fi(k r -i+i,Xi) ® Xi-i 

msb h/2 {P) <- x r+ i, lsb b/2 (P ) 4- x r 

return P £ {0, l} 6 

the most (least) significant x-bit of y. 


Then we define SP-type F-functions which are a special type of F-function 
constructions mm- 


Definition 2. (SP-Type F-Function) 

Let the length of round key k' = 6/2. Let m be the number of S-boxes in a round, 
and n be the size of the S-boxes, with mn = 6/2. Let Sij : {0, 1}" — ► {0, 1}" be 
the j-th S-box in the i-th round, and let Si : {0, l} 6 / 2 —* '{0, l} b / 2 be the function 
generated by concatenating m S-boxes in the i-th round. Let Pi : {0, l} 6 ' 2 — > 
{0, l} b / 2 be the linear Boolean function. 

Then SP-type F-functions are defined as Fi(xi,ki) = Pi(Si( Xi ® kf)). Note 
that we define the intermediate variables Zi = Si(xi ® fcj). 


Definition 3. ((m,n,r)-SPMFC) 

An ( m,n,r)-SPMFC is defined as an r -round Feistel cipher with SP-type round 
function using m n-bit S-boxes, and for which all Sij, Pi are bijective. An mn x 
mn matrix Mi (1 < i < r) over GF( 2) denotes a matrix representation of a 
linear Boolean function Pi of (m, n, r)-SPMFC. 

We also give definitions of bundle weight and branch number [4] . 

Definition 4. (Bundle Weight) 

Let x £ {0, l} kn , where x is represented as a concatenation of n-bit values as 
x = [xqX\ . . . Xk~ i], Xi £ {0, 1}", then the bundle weight w n (x) of x is defined as 

W n (x) = ${Xi\Xi /= $ . 


Definition 5. (Branch Number) 

Let 6 : {0, l} kn —* {0, l} ln . The branch number of 6 is defined as 
B(6) = nunjw n (a) +w„(0(a))} . 
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Remark 1. The maximum branch number is B{9) = 1 + 1. If a linear function has 
a maximum branch number, it is called an optimal diffusion mapping [2]. 
It is known that an optimal diffusion mapping can be obtained from maximum 
distance separable codes known as MDS codes 0]. 

3 Previous Work 

The precise estimation of the lower bound of the number of active S-boxes of 
block ciphers has been known as one of the practical means to evaluate ci- 
phers, because this lower bound can be used to calculate the upper bound of 
the differential characteristic probability or the linear characteristic probabil- 
ity [MMTUT71I7M]. Shimizu has shown a conjectured lower bound of the number 
of differentially and linearly active S-boxes for certain (m, n, r)-SPMFC block 
ciphers, in which a unique optimal diffusion mapping is repeatedly used in all 
F-functions [16] . Since such optimal diffusion mappings can be obtained from a 
generation matrix of an MDS code, we call the design MDS-Feistel [4ll2lH8]. 

Shimizu showed the following formula. 

Conjecture 1. Let A be an mn x mn matrix over GF( 2) of an optimal diffusion 
mapping with maximum branch number m + 1. Let E be an (to, n, r)-SPMFC 
block cipher and all matrices of diffusion layers are represented by the unique 
matrix Mj = A (1 < i < r ) . Then a lower bound of the differentially and linearly 
active S-boxes of E is conjectured as 

L(r ) = |_r/4j (to + 2) + (r mod 4) — 1 . (1) 

In Table [H the columns indicated by ‘Ml’ show the conjectured lower bounds 
of number of active S-boxes, and the data of the conjectured values are plotted 
on the left side of Fig. |3] This simple relation between the round number and the 
guaranteed number of active S-boxes is considered as a useful tool for evaluating 
similar kinds of block cipher designs. While this conjecture has not been proved, 
empirically, it has been partially confirmed [18] . 

Recently, at FSE 2004, Shirai and Shibutani proposed a novel design approach 
to improve the minimum number of active S-boxes of Feistel ciphers by employ- 
ing optimal diffusion mappings across multiple round functions, the ODM-MR 
design approach m- By carefully analyzing the difference cancellations, they 
found the following properties: 

Property 1. Let E be an (to, n, r)-SPMFC block cipher. 

— For matrices Mj (1 < i < r), if every concatenation of two matrices Mj 
and Mj+a for all possible j, denoted by [M ? jMj_|_ 2 ], is an optimal diffusion 
mapping, the minimum number of differentially active S-boxes is increased 
from an MDS-Feistel cipher. 

— Additionally, if each concatenation of three matrices Mj , Mj + 2 and Mj + 4 for 
all possible j, denoted by [Mj \Mj + 2 \Mj + 4 ,], is an optimal diffusion mapping, 
the minimum number of differentially active S-boxes is increased further 
than when only satisfying the above conditions on two matrices. 
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— Even if the number of concatenated matrices is larger than 3, no explicit 
gain of the number of active S-boxes has been observed in their simulations. 

These results imply that by avoiding a linear correlation between F-functions 
in round (i,i + 2) or rounds (i, i + 2, i+4), the ODM-MR construction guarantees 
more active S-boxes. 

In TableHJ the columns indicated by ‘D’ show the result of the improved min- 
imum number of differentially active S-boxes when every concatenated matrix 
of three matrices [Mj|M i+2 |-^i+ 4 ] is an optimal diffusion mapping. The graph 
of the corresponding values are shown on the left side of Fig. [5] 

This result opened a new line of research on developing more efficient Feistel 
ciphers. On the other hand a theoretical justification of the gain of the proposed 
construction and an explicit method to improve the immunity against both dif- 
ferential and linear cryptanalysis remained unsolved. 


4 Proofs of Effectiveness of the ODM-MR Design 

In this section, we provide the first proofs for the effectiveness of the ODM- 
MR design using three different matrices. We also show an additional condition 
and some proofs in order to improve the lower bound of linearly active S-boxes 
by using two different matrices. Our main contribution is to show the following 
corollary which presents a simple relation between the number of rounds and the 
guaranteed numbers of active S-boxes in the ODM-MR design. In the corollary, 
note that t M denotes the transpose matrix of a matrix M. 

Corollary 1. Let E be a (m,n,r)-SPMFC block cipher where r > 6. 

If [Mi\M i+ 2 \Mi + 4 ] and [ t Mr 1 |*M“ | 1 2 ] are optimal diffusion mappings for anyi,j 
(1 < i < r — 4, 1 < j < r — 2), respectively, any 3 R consecutive rounds (R > 2) 
in E guarantee at least R{m + 1) differentially and linearly active S-boxes. 

Fig. [T] illustrates the statement of the corollary. By using the Corollary 1, 
we can guarantee theoretically arbitrary number of active S-boxes by increasing 
the number of rounds. Since the corollary can be immediately obtained from 
two theorems, i.e. Theorem [T] and Theorem [5] the following two subsections are 
devoted to the proofs of these theorems. To ease the proofs, we first introduce 
an additional definition. 

Definition 6. Consider a differential characteristic or linear approximation. 
Let Di and L, denote the number of differentially and linearly active S-boxes 
in the i-th round, respectively. These values are determined by the difference 
Axi, Azi or by the linear mask rxi,Tzi as follows. 

Di = w n (Axi) = w„(Azi) , Li = w n (rxi) = w„(rzi) , 

where w n (-) is the bundle weight as defined in Definition ^ J 
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Fig. 1. Guaranteed Active S-boxes by ODM-MR design 


Remark 2. Note that a given difference characteristic always contains a nonzero 
input difference, since any (m, n, r)-SPMFC’s F-functions are bijective. Hence 
we obtain the following conditions: 

(dO) A = o =► A— 2 /= PA-i /= PA+i /= PA +2 /= o, 

(di) A = o =► A-1 = A+i • 

Since a linear approximation always contains a nonzero input mask, we obtain 

(JO) A = o => A - 2 /= PA-i /= PA+i /= PA+2 /= o, 

(11) a = o => A-i = A+i ■ 


4.1 Proofs for the Lower Bound of Differentially Active S-Boxes 

In this section we prove Theorem 1; the proof is based on five lemmata. 

Lemma 1 shows relations between D t of (m, n, r)-SPMFC when every Mj is 
an optimal diffusion mapping. 

Lemma 1. Let E be an ( m,n,r)-SPMFC block cipher. If every Mi has maxi- 
mum branch number m + X, then E satisfies the following condition ( d2 ). 

(■ d2 ) A+i /= 0=> Di + A+i + A+2 > m + 1 . 

Proof. From the relation between the differences Az.- l+ -[ ,Axi and Axi + 2 in a 3 
consecutive rounds, we obtain the following equation. 

M i+ iAz i+ i = Axi ® Ax i+ 2 ■ 

Since Mj has maximum branch number m+lwe have 

w n (Az i+ i) /= Q=> w n (Az i+1 ) + w n (Axi © Ax i+2 ) > m + 1 . (2) 

Eq. © and the inequality w n (Axi) + w n (Axi + 2 ) > w n (Axi © Axi +2 ) yield 
(d2). □ 
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Remark 3 . By combining Remark | 2 ] and (d 2 ) , we can obtain additional under- 
lying conditions (dS) and (d 4 ). 

(d 3 ) -A = 0, =#• A+i + A+2 ^ 77 i + 1 , 

(d 4 ) A+2 = 0, =>■ A + A+i > m + 1 . 

Equations (c/ 3 ) and (d 4 ) mean that if round k has no active S-boxes, any 
2 consecutive rounds next to round k always contain more than m + 1 active 
S-boxes. 

Next, we show the property of (m, n, r)-SPMFC in which every [Mi\M i+ 2\ is 
an optimal diffusion mapping. This is true for the ODM-MR. 

Lemma 2. Let E be a (m,n,r)-SPMFC block cipher. If every [Mj\M i+ -2\ has 
maximum branch number m+ 1 , E satisfies the following conditions (d 5 ), (d6). 

(d 5 ) A+ 4 = 0 => A + A+i + A+3 > m + 1 , 

(d6) A = 0 => A+i + A+3 + A+4 > m + 1 . 

Proof. From the relation between 5 -round differences, 

M i+ iAz i+ i ® M i+ 3 Azi + 3 = Axi ® Axi + 4 . 


Then, 

[Mi+ilMi+s] ( 1 ^) =Axi®Ax i+i . 

Since [M i+ i \M l+ f\ has maximum branch number m+ 1 , and from Remark [2 
we see that w n (Azi + 1) = 0 and w n (Azi + 3) = 0 will never occur simultaneously, 
we obtain 


w n (Az i+ 1) + w n (Az i+3 ) + w n (Axi © Ax i+i ) > m + 1 . 

By assuming the cases Ax^ = 0 or Ax i+ 4 = 0 , we directly obtain (d 5 ) and 

(d6). □ 

By using the previously obtained conditions (d 0 ) — (d6), we show the following 
lemma for the guaranteed number of differentially active S-boxes of (m, n, r)- 
SPMFC. 

Lemma 3 . Let E be a (m,n,r)-SPMFC block cipher where r > 6. If every 
[ Mi\Mi + 2 \ is an optimal diffusion mapping, then any 6 consecutive rounds in 
E guarantee at least 2 (m + 1 ) differentially active S-boxes. 

Proof. Consider the total number of active S-boxes in 6 consecutive rounds from 
the i- th round, 

i+5 

'y ' A: = Di + A+l + A+2 + A+3 + A +4 + A+5 • 
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If A + 1 /= 0 andA+4 /= 0, the condition (d2) guarantees thatO* + A+i + 
A +2 >m + 1 and A+ 3 + A +4 + A +5 > m + 1. Therefore we obtain A > 
2(m — 1). 

If A+i = 0, 

2+5 

^2 Dk = Di + A+2 + A+3 + A+4 + A+ 5 • 

From (dl), 

2+5 

^ A = 2 • a+2 + A+3 + A+4 + A+5 

= (A +2 + A+3) + (A +2 + A+4 + A+ 5 ) • 

From (d 3 ) and (d6), 

2+5 

^2 A > (rn + 1) + (m + 1) = 2 (m + 1) . 


The case of A+4 = 0 is proven similarly from (dl), (d 4 ) and (d 5 ). □ 

Next, we show the property of an (m, n. r)-SPMFC in which every 
[M, : | A+2I A+4] has maximum branch number. This coincides with one of the 
ODM-MR design. 

Lemma 4 . Let E be a (m,n,r)-SPMFC block cipher. If every [M t \ M i+ 2 | M, :+4 ] 
is an optimal diffusion mapping, then E satisfies the following condition (d 7 ). 

(d 7 ) a = A +6 = 0 => A+1 + a+3 + a+5 > m + 1 . 

Proof. First, from the difference relation in 7 consecutive rounds, we obtain 
Mi+iAzi+i © M i+ 3 Az i+ 3 0 M i+ 5 Az i+ 5 = Axt 0 Ax i+6 . 


Then, 

(Az i+1 \ 

[M i+ i\M i+ 3 \M i+5 ] I Az i+ 3 I = Axi 0 Ax i+e ■ 

\Az i+5 J 

Since [ M. ; + -1 1 M; L + 3 1 Mi + 5 ] has maximum branch number, and from Remark^ 
w n (Azi + i ), w n (Azi+ 3 ), and w n (Azi +3 ) cannot be simultaneously 0, we get that 

w n (Az i+1 ) + w n (Azi- 1_ 3 ) + w n (Az i+ 5 ) + w n (Axi 0 Ax i+e ) >m + 1 . 

By assuming Axi = 0 and Ax i+ a = 0 , we derive the condition (d 7 ). □ 

From the additional condition (d 7 ), we derive the following lemma. 

Lemma 5 . Let E be a (m,n,r)-SPMFC block cipher where r > 9 . If every 
[Mj|Mj + 2|Mj_|_4] is an optimal diffusion mapping, then any 9 consecutive rounds 
in E guarantee at least 3 (m+ 1 ) differentially active S-boxes. 
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Proof. Consider the total number of active S-boxes in 9 consecutive rounds, 

A = A + A+ 1 4- A+2 + A+3 + A+4 + A+5 + A+6 + A+7 + A+8 • 

If A +1 /= 0 thenDj + A +1 + A +2 > m + 1 from (d2), and Lemma [3] guaran- 
tees that the sum of the remaining 6 consecutive rounds is equal to J^fc=i +3 A > 
2(m+ 1). Consequently X/fcS A > 3(m + 1). Similarly, if A +7 /= 0, at least 
3(m + 1) active S-boxes are guaranteed. 

If A+i = A+7 = 0, we obtain 

i+8 

yy A = A + A+2 + A+3 + A+4 + A+5 + A+6 + A+8 . 

k=i 

From (dl), 

i+8 

^2 A = 2 ■ a+2 + A+3 + A+4 + A+5 + 2 ■ A+6 

= (A+2 + A+3) + (A+2 + A+4 + A+6) + (A+5 + A+6) • 

From (d3), (d7) and (d4), 

i+8 

> (m + 1) + (m + 1) + (to + 1) = 3(m + 1) . 

k=i 

As a consequence, we have shown that any 9 consecutive rounds of E guar- 
antee at least 3(m + 1) differentially active S-boxes. □ 

We conclude this section with 

Theorem 1. Let E be an ( m,n,r)-SPMFC block cipher where r > 6. If every 
[Mi|Mj_|_ 2 |Mj+ 4 ] is an optimal diffusion mapping, any 3 R consecutive rounds in 
E guarantees at least R(m + 1) differentially active S-boxes. 

Proof. Any integer 3 R (R > 2) can be written as 3 R = 6k+ 9 j (k + j > 1, 2k + 

3 j = R). From lemmata [3] and O 6 and 9 consecutive rounds of E guarantee 
2 (to + 1) and 3(m + 1) differentially active S-boxes, respectively. Therefore, E 
guarantees fc*2(m + l)-t-j*3(m-|-l) = (2/c + 3j)(m + l) = R(m+1) differentially 
active S-boxes. □ 

4.2 Proofs for the Lower Bound of Linearly Active S-Boxes 

In this subsection, we will show the proof of the guaranteed number of linearly 
active S-boxes of (m, n, r)-SPMFC with ODM-MR design. 

Theorem 2. Let E be an (m,n,r)-SPMFC block cipher. If every [ t M i _1 | t M i 7 l 2 ] 
is an optimal diffusion mapping for any i, any 3 R consecutive rounds in E has 
at least R(m + 1) linearly active S-boxes. 
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Proof. From the 3-round linear mask relation, 

rxi + 1 = t M^ 1 Tzi ® ■ 

Then, 

r Si+ , = pM-“M- + y( r ^< 2 ) . 

Since [ t M~ 1 \ t M^ L 2 ] has maximum branch number m + 1, and from Remark 
[U w n (r Zi ) and w„(rz i+ 2 ) cannot be simultaneously 0, we obtain 

w n (Tzi) + w n (rxi+i) + w n (T Zi+ 2 ) > m + 1 . 

By using the notion of L,, this implies, 

(Zl) Li + L i+1 +L i+2 >m + l . 

This shows that every 3 consecutive rounds guarantees at least m + 1 lin- 
early active S-boxes. Consequently, any 3 R consecutive rounds in E guarantees 
Eltf _1 L k > R(m + 1). □ 

Finally, by simply combining Theorems 1 and 2, the claimed Corollary 1 
follows directly. Appendix A contains example matrices that satisfy the ODM- 
MR design. 


5 Discussion 

5.1 Comparison of ODM-MR and MDS-Feistel 

To discuss the implications of this new design approach, we show empirical search 
results for the cases r = 12, m = 4, ..,8. To obtain these results we employed a 
weight based search method. This approach has been used by Shirai and Shibu- 
tani before [T5] , Our results are shown in Table [TJ In the table, the values for 
more than 13-rounds are interpolated by the corollary and Shimizu’s conjec- 
ture. Note that the simulation results completely match the lower bound values 
predicted by the corollary, which are denoted by the underlined values. These 
results show the superiority of ODM-MR design over MDS-Feistel explicitly. 

Fig. [5] shows graphs of the results in Table Q] and five auxiliary lines y = 
(m + l)a;/3 are added where m = 4, .., 8. These lines connect the lower bounds 
values of every 3i?-round. 

The left side of Fig. [3] shows an estimated lower bound of MDS-Feistel and 
approximate lines y = (m+2)x/4—l. To see the effect of the ODM-MR approach 
graphically, the right side of Fig. [3] includes the approximated lines for ODM-MR 
and MDS-Feistel for m = 4 and m = 8. The differences of the gradients show 
explicitly the advantage of the ODM-MR approach. 
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Table 1. Lower Bounds of MDS-Feistel and ODM-MR design 



D: numbers of differentially active S-boxes of ODM-MR 
L: numbers of linearly active S-boxes of ODM-MR 



Fig. 2. Lower bounds of the ODM-MR design ( m = 8) 


5.2 Active S-Box Ratio 

In this subsection, we compare the ODM-MR approach to other design ap- 
proaches using the new type of approach. Since we obtained a formal bound 
for the lower bound of the ODM-MR design approach, we can compare it to 
other well known design approaches based on the concept of active S-box ratio 
introduced by Shirai and Shibutani [TS] , 

Let active{r , m) be the number of guaranteed active S-boxes for an r-round 
cipher which employs m x m diffusion matrices over GF( 2") in its diffusion 
layer. For example, active(r, m) of the MDS-Feistel design can be written as 
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Fig. 3. Comparison of MDS-Feistel and ODM-MR design 


active(r , to) = (m + 2) l_r/4j + a r ^ m , 

where a r rn = (r mod 4) — 1 . Generally, a r . m is a function which maximum 
absolute value is proportional to m and lim r ^ 00 a. r ^ rn lr = 0. 

Next, let total(r, to) be the total number of S-boxes in an r-round cipher. The 
ratio of the number of active S-boxes to the total number of S-boxes becomes 


ratio(r, m) = 


active(r, m) (m + 2) |_r/4j + a r ^ m 
total (r,m) rm 


By using the definition of active S-box ratio, we can study the characteristic of 
the MDS-Feistel design. For example, consider a 128-bit block cipher employing 
8-bit S-boxes. For m = 8, ratio(r, 8) will converge to a specific value when r goes 
to infinity, 

lim ratio(r, 8) = lim ^ L r /^J ar > 8 _ 12 = 0.3125 . 
r—*oo K 1 r— >oo 8r 32 


This implies that about 31% of all S-boxes will be active for a very large 
number of rounds. This limit can be considered as a potentially guaranteed 
ratio of active S-boxes corresponding to the chosen m. 

Also, we can take the limit of ratio(r, m) when both r and m tend to infinity, 


lim ratio(r,m ) = 


(to + 2) [r /4J + a T}1 
rm 


4 


0.25 . 


Even though huge r and to are not practical in the real world, the value can 
be understood as an indicator of the potential efficiency of a particular design 
strategy. 

We propose these limits as a reference to evaluate the efficiency of the linear 
diffusion layer of the cipher and use them to compare ciphers employing different 
design strategies. The following table contains the convergence values of the 
“MDS-Feistel” andth ODM-MR” design. Additionally, the following “Rijndael 
type” and ” SHARK type” design approaches are also evaluated for reference. 
Rijndael Type: A nm 2 - bit SPN block cipher design whose round function 
consists of key-addition, to x to parallel n-bit S-boxes, a MixColumn employing 
to to X to matrices over GF{2 n ) and a ShiftRow operation [4|. 
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Table 2. Comparison of the Active S-box Ratio 


Type active(r,m) total (r 7 m) 

128bit blk. limr-oc, 

lim m , r _ voo 

MDS-Feistel (m + 2) |r/4j + a r , m rm 

m = 8 

0.313 

0.25 

ODM-MR (m + 1) Lr/3J + /3 r , m rm 

m = 8 

0.371 

0.33 

Rijndael type (m + l) 2 |//4J + ‘Jr ,m rm 2 

m = 4 

0.391 

0.25 

SHARK type (m + 1) |r/2j + <9 r , m rm 

m — 16 

0.531 

0.5 


SHARK Type: A nm-bit SPN block cipher design where m parallel n-bit 
S-boxes, an m x m matrix over GF{ 2") are employed 01- 

Note that all four designs employ optimal diffusion mappings in their diffusion 
layers; they have block length of 128 bits with 8-bit S-boxes. The result shows 
that the ODM-MR approach has the better limit than MDS-Feistel in the 128- 
bit block setting which is also confirmed by the empirical results in the previous 
section. We also know that ODM-MR ’ s limit is closer to that of the Rijndael 
design approach than MDS-Feistel. 

Moreover, the limit value of the ODM-MR approach, when both r and m tend 
to infinity, exceeds that of the Rijndael type construction. This is due to the fact 
that the ODM-MR approach guarantees a certain number of active S-boxes for 

3 consecutive rounds, while the Rijndael-type approach has such a property for 

4 consecutive rounds. 

The values of SHARK are still the highest, because the design strategy has a 
2-round property. However, there seems to be a tradeoff for the implementation 
cost, as SHARK-type design requires matrices which are twice as large as the 
matrices in the MDS-Feistel and ODM-MR and four times as large as in the 
Rijndael approach. 


6 Conclusion 

We provide a theoretical motivation for the ODM-MR design. We first give a 
theoretical reason of ODM-MR , and found additional conditions and proofs to 
improve the immunity against differential and linear cryptanalysis. As a result, 
we showed that the ODM-MR design approach guarantees at least R(m + 1) 
active S-boxes in 3 R consecutive rounds (R. > 2) where m is the number of S- 
boxes in a round. This guaranteed number of active S-boxes was compared with 
the design approach of other well-known designs namely SHARK, Rijndael, and 
MDS-Feistel ciphers. We were able to show that our design approach outperforms 
some of the other designs. 

Acknowledgments. We thank An Braeken and Christopher Wolf for carefully 
reading the earlier version of the paper. We thank the anonymous referees for 
helpful comments. 
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Appendix A 

We show one of methods to construct a Feistel cipher satisfying the ODM-MR 
design. To construct a concrete cipher, at least three mxm matrices over GF( 2”) 
are required to satisfy all the ODM-MR conditions. The construction steps are: 

1. Choose mxm matrices Ao, Ai, A 2 over GF(2 n ) such that, 

(a) Every square submatrix of [A 0 |Ai|A 2 ] is nonsingular, 

(b) Every square submatrix of > [^r] an d [^prr] * s nons i n g u l ar - 

2. Set these three matrices as Mgj+i = M 2r - 2 i = A rno ,i 3 , for (0 < i < r) in 
a Feistel cipher with 2r rounds. 

Note that all operations in Step 1 are over GF( 2") although the optimal 
diffusion conditions for [MjMi +2 M i+4 ] and [ t M^ lt M^ 2 \ are given over GF{2). 
Here we show an example of three matrices Ao, A 4 , A 2 for the case m = 4. 

Example 1. The following matrices A 0 , A-j , A 2 satisfy the ODM-MR conditions. 

( aeecb9 3e\ /b8fl65ef\ 

81 25 13 d4 A — \ 3a f 6 2d 6a 1 

db 9d 4 lb ’ 2 _ 4a 97 a3 b9 

9e 3a 91 39 / \ 82 5f a2 cl ) 

Each element is expressed as hexadecimal value corresponding to a binary 
representation of elements in GF( 2 s ) with a primitive polynomial p(x) = x s + 
x 4 + x 3 + x 2 + 1. From the corollary, a (4,8, 12)-SPNFC employing the above 
matrices A 0 , Aj , A 2 as outlined in Fig. 0] guarantees 10, 15 and 20 differentially 
and linearly active S-boxes in 6, 9 and 12 consecutive rounds, respectively. 


( 9d b4 d3 5d\ 
29 34 39 60 
67 6a d2 e3 
8e d7 e6 lb ) 



Fig. 4. Example Allocation of Matrices Ao, Ai, A 2 
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Abstract. We describe highly efficient constructions, XE and XEX, 
that turn a blockcipher E: K.X {0, 1}™ — ► {0, 1}" into a tweakable block- 
cipher E: K. X T x {0, l} n — > {0, 1}" having tweak space T = {0, 1}" X I 
where I is a set of tuples of integers such as I = [1 .. 2"^ 2 ] x [0 .. 10]. When 
tweak T is obtained from tweak S by incrementing one if its numerical 
components, the cost to compute E]^(M) having already computed some 
Ek(M') is one blockcipher call plus a small and constant number of el- 
ementary machine operations. Our constructions work by associating 
to the i th coordinate of I an element on € F^n and multiplying by a,; 
when one increments that component of the tweak. We illustrate the use 
of this approach by refining the authenticated-encryption scheme OCB 
and the message authentication code PMAC, yielding variants of these 
algorithms that are simpler and faster than the original schemes, and yet 
have simpler proofs. Our results bolster the thesis of Liskov, Rivest, and 
Wagner [10] that a desirable approach for designing modes of operation 
is to start from a tweakable blockcipher. We elaborate on their idea, sug- 
gesting the kind of tweak space, usage-discipline, and blockcipher-based 
instantiations that give rise to simple and efficient modes. 


1 Introduction 

Liskov, Rivest and Wagner m defined the notion of a tweakable blockcipher and 
put forward the thesis that these objects make a good starting point for doing 
blockcipher-based cryptographic design. In this paper we describe a good way 
to build a tweakable blockcipher E out of an ordinary blockcipher E. Used as 
intended, our constructions, XE and XEX, add just a few machine instructions 
to the cost of computing E. We illustrate the use of these constructions by 
improving on the authenticated-encryption scheme OCB m and the message 
authentication code PMAC [4]. 
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Tweakable blockciphers. Schroeppel [16] designed a blockcipher, Hasty 
Pudding, wherein the user supplies a non-secret spice and changing this spice 
produces a completely different permutation. Liskov, Rivest, and Wagner [TU] 
formally defined the syntax and security measures for such a tweakable blockci- 
pher, and they suggested that this abstraction makes a desirable starting point 
to design modes of operation and prove them secure. They suggested ways to 
build a tweakable blockcipher E out of a standard blockcipher E, as well as 
ways to modify existing blockcipher designs to incorporate a tweak. They il- 
lustrated the use of these objects. Formally, a tweakable blockcipher is a map 
E: K. x T x {0, 1}" — ► {0, 1}" where each Ejr{-) = E(K , T, •) is a permutation 
and T is the set of tweaks. 

Our contributions. We propose efficient ways^to turn a blockcipher E: K x 
{0, 1}" — ¥ {0, 1}" into a tweakable blockcipher E: K, x T x {0, 1}" — > {0, 1}". 
(See Appendix 0 for the best constructions formerly known.) Our powering-up 
constructions, XE and XEX, preserve the key space and blocksize of E but 
endow E with a tweak space T = {0, 1}" x I where I is a set of tuples of 
integers, like I = [1 .. 2"/ 2 ] x [0 .. 10]. The XE construction turns a CPA-secure 
blockcipher into a CPA-secure tweakable blockcipher, while XEX turns a CCA- 
secure blockcipher into a CCA-secure tweakable blockcipher. (CPA stands for 
chosen-plaintext attack and CCA for chosen-ciphertext attack.) The methods 
are highly efficient when tweaks arise in sequence, with most tweaks ( N , i) being 
identical to the prior tweak (N, i 7 ) except for incrementing a component of i. 

As an illustrative and useful example, consider turning a conventional blockci- 
pher E\ K. x {0, 1}" — > {0,1}" into a tweakable blockcipher E: /C x T x {0, 1}" — > 
{0, 1}" by defining E‘^ tj (M) = E K (M ® A) ® A where offset A = 2 l V N and 
N = Ejc(N). Arithmetic is done in the finite field F 2 /> . For concreteness, assume 
n = 128 and a tweak space of T = {0, 1}" X [1 .. 2 64 ] x [0 .. 10]. We show that E is 
secure (as a strong, tweakable PRP) as long as E is secure (as a strong, untweak- 
able PRP). Computing E^ lj (X) will usually cost about 1 shift, 1 conditional, 
and 3-4 xors more than computing Ek{X). 

We illustrate how the use of tweakable blockciphers during mode design, fol- 
lowed by the instantiation of the tweakable blockcipher with an ordinary block- 
cipher using one of our constructions, can give rise to modes that are simpler, 
faster, and easier to prove correct than what designing directly from a blockcipher 
has delivered. We do this by refining two already-optimized modes, OCB m 
and PMAC [4], yielding new modes, OCB1 and PMAC1, that are are easier 
to understand, easier to implement, and faster. Computing offsets in the new 
modes does not involve Gray-code sequence or counting the number of trailing 
zero bits in successive integers. OCB1 eliminates the utility of preprocessing, 
saving a blockcipher call. 

Intuition. The idea behind the powering-up constructions can be explained 
like this. Apart from Gray-code reordering, PMAC authenticates an m-block 
message using a sequence of offsets L, 2 L, 31/, . . . , (m — 1)1/, where multiplica- 
tion is in the finite field F 2 ™ and L = Ek( 0") is a variant of the underlying 
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key K. When a special kind of offset is needed, a value huge • L is added (xored) 
into the current offset, where huge is so large that it could never be among 
{1,2, . . . ,m — 1}. What we now do instead is to use the easier-to-compute se- 
quence of offsets 2 1 L,2 2 L, . . . ,2 m ~ 1 L. We insist that our field be represented 
using a primitive polynomial instead of merely an irreducible one, which ensures 
that 2 1 ,2 2 ,2 3 , . . . ,2 2 -1 will all be distinct. When a special offset is needed we 
can no longer add to the current offset some huge constant times L and expect 
this never to land on a point in 2 1 L, 2 2 L , . . . , 2 m ~ 1 L. Instead, we multiply the 
current offset by 3 instead of 2. If the index of 3 (in Fjjjn) is enormous relative 
to the base 2 then multiplying by 3 is equivalent to multiplying by 2 buge and 
2*3 L won’t be among of 2 1 L, 2 2 L, . . . , 2 m ~ 1 L for any reasonable value of m. The 
current paper will make all of the ideas of this paragraph precise. 

Further related work. Halevi and Rogaway [7] used the sequence of off- 
sets 2L, 2 2 L, 2 3 L, . . . , in their EME mode. They give no general results about 
this construction, and EME did not use tweakable blockciphers, yet this offset 
ordering was our starting point. 


2 Preliminaries 

The field with 2 n points. Let F 2 n denote the field with 2 n points and let F| ra 
be its multiplicative subgroup. We interchangeably think of a point a £ F 2 n as 
an n-bit string, a formal polynomial of degree n — 1, or as an integer in [0 .. 2"— 1], 
To represent points select a primitive polynomial, say the lexicographically first 
one among the degree n polynomials having a minimum number of nonzero 
coefficients. For n = 128 the indicated polynomial is pi 28 (x) = x 128 + x 7 -f 
x 2 + x + 1. Saying that p„(x) is primitive means that it is irreducible over F 2 
and 2 (i.e., x) generates all of F 2 „. It is computationally simple to multiply 
a £ {0, 1}" by 2. To illustrate for n = 128, 2a = a<Cl if firstbit(a) = 0 and 
2a = (a<Cl) ® 0 12 °10 4 1 3 if firstbit(a) = 1. One can easily multiply by other small 
constants, as 3a = 2a ® a and 5a = 2 (2a) ® a and so forth. 

Blockciphers and tweakable blockciphers. We review the standard defi- 
nitions for blockciphers and their security [5] and the extension of these notions to 
tweakable blockciphers [TO] . A blockcipher is a function E: ICx {0, 1}” — > {0, 1}" 
where n > 1 is a number and 1C is a finite nonempty set and E[K, •) = 
Ek{-) is a permutation for all K £ 1C. A tweakable blockcipher is a function 
E: 1C x T x {0, l} n — > {0, 1}" where n and 1C are as above and T is a nonempty 
set and E(K,T,-) = Ej(-) is a permutation for all K £ 1C and T £ T. For 
blockciphers and tweakable blockciphers we call n the blocksize and 1C the key 
space. For tweakable blockciphers we call T the tweak space. 

Let Perm(n) be the set of all permutations on n bits. Let Perm(T, n) be the 
set of all mappings from T to permutations on n bits. In writing n <— Perrn(n) we 
are choosing a random permutation 7r(-) on {0, 1}". In writing n <— Perm (T, n) 
we are choosing a random permutation n(T, •) = 7Tt(-) on {0, 1}" for each T £ T. 
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HE-. K x {0, 1}" — ► {0, 1}” is a blockcipher then its inverse is the blockcipher 
D = E- 1 where D: K x {0, 1}" — {0, 1}” is defined by D(K, Y) = D K (Y ) being 
the unique point X such that E K (X) = Y. If E: K. x T x {0, 1}" — * {0, 1}" is 
a tweakable blockcipher then its inverse is the tweakable blockcipher D = E~ l 
where D: 1C x T x {0, 1}" -» {0, 1}" is defined by D{K,T,Y ) = D T K {Y) being 
the unique point X such that E^(X) = Y. 

An adversary is a probabilistic algorithm with access to zero or more oracles. 
Without loss of generality, adversaries never ask a query for which the answer 
is trivially known: an adversary does not repeat a query, does not ask Dk(Y) 
after receiving Y in response to a query E K (X), and so forth. Oracles will have 
an implicit domain of valid queries and, for convenience, we assume that all 
adversarial queries lie within that domain. This is not a significant restriction 
because membership can be easily tested for all domains of interest to us. 

Definition 1 (Blockcipher/Tweakable-Blockcipher Security). Let E: K.X 

{0, 1}" — > {0, l} n be a blockcipher and let E: K. x T x {0, 1}" — > {0, 1}" be a 
tweakable blockcipher. Let A be an adversary. Then Adv r / k rp (A), Adv^ prp (A), 
Adv|T(A), and Adv~ prp (A) are defined by: 

Pt[K^JC: A b *(')=M]— P r[7r^-Perm(n): =>■ 1] 

Pr [K<±K\ A®*M°*«=kl}-Pr[7r^Perm(n): 

Pr [K^-K: => 1] - Pr[7r 4- Perm(T, n) : => 1] 

Pr [K^-1C: -Pr[7r^-Perm(T,n) : =k 1] □ 

Of course D and D denote the inverses of blockciphers E and E. In writing 
A =>• 1 we are referring to the event that the adversary A outputs the bit 1. 

In the usual way we lift advantage measures that depend on an adver- 
sary to advantage measures that depend on named resources: Adv™(7£) = 
rnax/t { Adv™ ( A) } over all adversaries A that use resources at most 72.. The 
resources of interest to us are the total number of oracle queries q and the total 
length of those queries o and the running time t. For convenience, the total length 
of queries will be measured in n-bit blocks, for some understood value of n, so a 
query X contributes \X\ n to the total, where \X\ n means max{|Jf|/n, 1}. Run- 
ning time, by convention, includes the description size of the algorithm relative 
to some standard encoding. When we speak of authenticity, the block length of 
the adversary’s output is included in o. 


3 The XE and XEX Constructions 

Goals. We want to support tweak sets that look like T = {0, 1}" X I where I 
is a set of tuples of integers. In particular, we want to be able to make I the 
cross product of a large subrange of integers, like [1 .. 2”/ 2 ], by the cross prod- 
uct of small ranges of integers, like [0..10] x [0..10]. Thus an example tweak 
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space is T = {0,1}" X [1..2™/ 2 ] x [0..10] X [0..10]. Tweaks arise in some se- 
quence Ti, T 2 , . . . and we will obtain impressive efficiency only to the extent that 
most tweaks are an increment of the immediately prior one. When we say that 
tweak T = (TV, i\ . . . . , i^) is an increment of another tweak we mean that one 
of got incremented and everything else stayed the same. The second 

component of tweak (TV, . . . , ik), meaning i\ , is the component that we ex- 
pect to get incremented most often. We want there to be a simple, constant-time 
procedure to increment a tweak at any given component of I. To increment a 
tweak it shouldn’t be necessary to go to memory, consult a table, or examine 
which number tweak this in in sequence. Incrementing tweaks should be endian- 
independent and avoid extended-precision arithmetic. Efficiently incrementing 
tweaks shouldn’t require precomputation. Tweaks that are not the increment 
of a prior tweak will also arise, and they will typically look like (TV, 1, 0 . . . , 0). 
Constructions should be reasonably efficient in dealing with such tweaks. 

We emphasize that the efficiency measure we are focusing on is not the cost 
of computing i?J( X) from scratch — by that measure our constructions will not 
be particularly good. Instead, we are interested in the cost of computing E^(X) 
given that one has just computed E^(X') and T is obtained by increment- 
ing S at some component. Most often that component will have been the second 
component of S. It is a thesis underlying our work, supported by the design of 
OCB1 and PMAC1, that one will often be able to arrange that most tweaks are 
an increment to the prior one. 

Tweaking with A = 2* N. Recall that we have chosen to represent points 
in F- 2 »*. using a primitive polynomial, not just an irreducible one. This means 
that the point 2 is a generator of F 2 «: the points 1, 2, 2 2 , 2 3 , . . . , 2 2 " -2 are all 
distinct. This property turns out to be the crucial one that lets us construct 
from a blockcipher E: 1C x {0, 1}" — ► {0, 1}" a tweakable blockcipher E: K. x 
({0, 1}" X [1 .. 2" - 2]) X {0, 1}" -* {0, 1}" by way of 

E%\M) = E K (M®A)m A where A = 2 i N and N = E K {N). 

The tweak set is T = {0, 1}" X I where I = [1 .. 2" — 2] and the tweakable 
blockcipher just described is denoted E = XEX[T, 2 1 ] . When computing the 
sequence of values E^ 1 (Mi), . . . , E^ m ~ 1 (M m -i) each E^ l (Mi) computation 
but the first uses one blockcipher call and one doubling operation. Doubling 
takes a shift followed by a conditional xor. We call the construction above, and 
all the subsequent constructions of this section, powering-up constructions. 

Tweaking by A = 2*3 J N. To facilitate mode design we may want tweaks that 
look like ( N,i,j ) where TV £ {0,1}" and i is an integer from a large set I, like 
I = [1 .. 2"/ 2 ], and j is an integer from some small set J, like JJ = {0, 1}. To get the 
“diversity” associated to the various ^-values we just multiply by 3 instead of 2. 
That is, we construct from a blockcipher E: K. x {0, 1}" — > {0, 1}" a tweakable 
blockcipher E: K. X ({0, 1}" X I X J) X {0, 1}" — > {0, 1}" by way of 

E% ij (M) = E k (M © A) © A where = 2 i 3 i N and N = E K (N). 
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The tweakable blockcipher just described is denoted E = XEX [A, 2 I 3 JI ]. In- 
crementing the tweak at component i is done by doubling, while incrementing 
the tweak at component j is done by tripling. 

The XEX construction. Generalizing the two examples above, we have the 
following definition. 

Definition 2 (XEX). Let E: JC x {0,1}" — > {0,1}" be a blockcipher, let 

fti ,(Xk G and let Ii, . .. ,1* C Z. Then E = XEXfAjo} 1 • • • oJ.*] is the 

tweakable blockcipher E: ICx ({0, 1}" x Ij x • • • x I fc ) x {0, 1}" — ► {0, 1}" defined 
by E^ ll " lk (M) = E K (M®A) ® A where A = a} 1 cdf • ■ ■ o} fe N and N = E K (N). 

The XE construction. As made clear in the work of Liskov, Rivest, and 
Wagner [10], constructions of the form Ej^(M) = E K (M®A)®A aim for chosen- 
ciphertext attack (CCA) security, while for chosen-plaintext attack (CPA) secu- 
rity one can omit the outer xor. Thus we consider the construction E K (M ® A). 
This is slightly more efficient than XEX, saving one xor. 

Definition 3 (XE). Let E: /Cx{0, 1}" — > {0, 1}" be a blockcipher, oi , . . . , otk £ 
F| n , andli, . . . ,Ifc C Z. Then E = XE[A, a} 1 ■ • • af- } is the tweakable blockcipher 
E: K.X ({0, 1}" X Ii x • • • x I fc ) x {0, 1}" -► {0, 1}" defined by E^- ik {M) = 
E k (M ® A) where A = o^o^ 2 • ■ • a}* N and N = E K (N). □ 

4 Parameter Sets Yielding Unique Representations 

It is easy to see that the XE and XEX constructions can only “work” if a} 1 • • • a}* 
are distinct throughout (A, ■ • ■ , ik) G Ii x • • • x I fe . This motivates the following 
definition. 

Definition 4 (Unique Representations). Fix a group G. A choice of pa- 
rameters is a list oi \ , . . . , as, £ G of bases and a set Ii X • • • x I/. C Z fc of 
allowed indices. We say that the choice of parameters provides unique rep- 
resentations if for every (?i, . . . , ( ji , ■ ■ ■ , jk ) G Ii x • • • X I*, we have that 
“l 1 ‘ ‘ ‘ = “l 1 ' ' ‘ a k implies (*x, . . . ,i k ) = ( ji , ■ • • , jk )- □ 

In other words, representable points are uniquely representable: any group 
element cc} 1 • • • a J.* that can be represented using allowed indices can be repre- 
sented in only one way (using allowed indices). 

For tweak spaces of practical interest, discrete-log calculations within F^,,. 
can be used to help choose and verify that a given choice of parameters provides 
unique representations. The following result gives examples for F^s- 

Proposition 1. [Can Use 2, 3, 7 When n = 128] In the group Fjias the 
following choices for parameters provide unique representations: 

(1) oi =2 and Ii = [-2 126 .. 2 126 ]. 

(2) ai,a 2 = 2,3 and Ii x I 2 = [— 2 115 ..2 115 ] x [— 2 10 ..2 10 ]. 

(3) 01,02,03 = 2,3,7 and Ii x x I 3 = [— 2 108 ..2 108 ] x [— 2 7 .. 2 7 ] x [— 2 7 .. 2 7 ]. 
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Proof. For statement (1) recall that 2 is a generator of the group (by our choice 
of irreducible polynomial) and the order of the group F* 12S is 2 128 — 1 and so 
2 * = 2 J iff i = j (mod 2 128 — 1 ) and so any contiguous range of 2 128 — 1 or fewer 
integers will provide unique representations with respect to base 2 . 

To prove statement (2) we need to compute log 2 3 in the group : 

log 2 3 = 338793687469689340204974836150077311399 (decimal) 

This and subsequent discrete logs were computed using a Maple- implementation 
combining the Pohlig-Hellman [TT] and Pollard-rho [T5] algorithms. (A naive im- 
plementation computes discrete logs in F^s in a few hours.) Now note that 2“3 b = 
2“'3 6 ' iff 2 a 2 bl °s = 3 = 2 a '2 b ' 10 ^ 3 iff 2 °+ 61o &* 3 = 2 a '+ b ‘ lo s = 3 iff a + &log 2 3 = 
a' + b' log 2 3 (mod 2 128 - 1) because 2 is a generator of the group F* 128 . Thus 
2“3 b = 2“'3 6 ' iff a - a' = (V - b) log 2 3 (mod 2 128 - 1 ). If b,V £ [- 2 10 .. 2 10 ] 
then Ab = b' — b £ [— 2 11 .. 2 11 ] and computer-assisted calculation then shows that 
the smallest value of Ablog 2 3 (mod 2 128 — 1) for Ab £ [— 2 11 ..2 11 ] and Ab /= 0 
is 16001og 2 3 = 00113a0ce508326c006763c0b80c59f9 (in hexadecimal) which is 
about 2 1161 . (By “smallest” we refer to the distance from 0, modulo 2 128 — 1, so2 100 
and (2 128 — 1) — 2 100 are equally small, for example.) Thus if a, a' are restricted to 
[— 2 115 .. 2 115 ] and b, b' are restricted to [— 2 10 .. 2 10 ] then A a = a — a! < 2 116 can 
never equal Ab log 2 3 (mod 2 128 — 1) > 2 116 unless A h = 0. This means that the 
only solution to 2°3 b = 2“ 3 b within the specified range is a = a' and b = b'. 

To prove statement (3) is similar. First we need the value 

log 2 7 = 305046802472688182329780655685899195396 (decimal) 

Now2“3 b 7 c = 2°'3 b '7 c ' iff a-a' = {b'-b) log 2 3+{c'-c) log 2 7 (mod 2 128 -1). 
The smallest value for A h log 2 3 + A c log 2 7 (mod 2 128 — 1) when Ab,A c £ 
[— 2 8 .. 2 8 ] and at least one of these is non-zero is —48 log 2 3+31 log 2 7 (mod 2 128 — 
1) = 00003bfabac91e02b278b7e69a379dl8 (hexadecimal) which is about 2 109 9 . 
So restricting the index for base -2 to [— 2 108 ..2 108 ] ensures that a — a' < 2 109 
while ( b ' — b) log 2 3 + (c' — c) log 2 7 > 2 109 unless b = b' and c = d and a = a ’ . □ 

We emphasize that not just any list of bases will work. Notice, for example, 
that 3 2 = 5 in F 2 „ so the list of bases 2, 3, 5 does not give unique representations, 
even for a tiny list of allowed indices like Ii x I 2 X I 3 = {0, 1, 2} 3 . 

Similar calculations can be done in other groups; here we state the analogous 
result for F* 64 . 

Proposition 2. [Can Use 2, 3, 11 When n — 64] In the group F * 64 the 
following choices for parameters provide unique representations: 

(1) O'! = 2 and [— 2 62 ..2 62 ]. 

(2) a 1 ,a 2 = 2,3 and [-2 51 .. 2 51 ] x [-2 10 ..2 10 ]. 

(3) ai, a 2 , a 3 = 2,3,11 and [-2 44 ..2 44 ] x [— 2 7 .. 2 7 ] x [— 2 7 .. 2 7 ]. □ 

This time 2, 3, 7 does not work as a list of bases, even with a small set of 
allowed indices like [1 .. 64] x {0, 1, 2} x {0, 1, 2}, due to the fact that 2 64 = 3 2 • 7 
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in this group. Machine-assisted verification seems essential here; a relation like 
that just given is found immediately when computing the possible values for 
Af, log 2 3 + A c log 2 7 (mod 2 64 — 1) but it might not otherwise be anticipated. 

5 Security of XE 

The following result quantifies the security of the XE construction. 

Theorem 1. [Security of XE] Fix n > 1 and let aq, ... , a*, £ F3[„ be base 
elements and let Ii x ■ • • x I*, be allowed indices such that these parameters 
provide unique representations. Fix a blockcipher E: K. x {0, 1}" — > {0, 1}" and 
let E = XE[E, aq 1 Then Adv£ rp (t, g) < Adv^ rp (f', 2q) + where 

t' = t+ ckn(q + 1) for some absolute constant c. □ 

In English, the XE construction promotes a CPA-secure blockcipher to a 
CPA-secure tweakable blockcipher, assuming that the chosen base elements and 
range of allowed indices provide unique representations. The proof is in HU. 

6 Security of XEX 

Some added care is needed to address the security of XEX. Suppose, to be 
concrete, that we are looking at XEX[£', 2 1 ] and I = [0..2" -2 ]. Let the ad- 
versary ask a deciphering query with ciphertext C = 0” and tweak (0",0). 
If the adversary has^a construction-based deciphering oracle then it will get a 
response of M = D^°(0 n ) = D K (A) ® A = D K ( N) © N = 0" © N = N, 
where N = E K { 0") = A. This allows the adversary to defeat the CCA-security. 
For example, enciphering 2 M = 2N with a tweak of (0", 1) and enciphering 
4 M = 4N with a tweak of (0 n ,2) will give identical results (if the adversary has 
the construction-based enciphering oracle). Corresponding to this attack we ex- 
clude any tweak ( N , *i, . . . , i*) for which (7| , . . . . ijf) is a representative of 1 — that 
is, any tweak (N. i x , . . . , i k ) for which a} 1 . . . a'jf = 1. In particular, this condi- 
tion excludes any tweak (N, 0, . . . , 0). The proof of the following is omitted, as 
Theorem [3] will be more general. 

Theorem 2 (Security of XEX). Fix n > 1 and let oti, ... ,ctk £ be base 
elements and let Ii x • • • xl* be allowed indices such that these parameters provide 
unique representations. Assume otf ■ ■ ■ a l £ /= If or all (*i, . . . , ik) £ Ii x • • • x I/.. 
Fix a blockcipher E: JC X {0,1}" — > {0,1}" and let E = XEX[E, a} 1 • ■■(*£}. 
Then Adv~ prp (f, q) < Adv^ prp (t', 2q) + where t' = t + ckn(q + 1) for 
some absolute constant c. □ 


7 An Almost-Free Alternative to Key Separation 

When combining two blockcipher-based cryptographic mechanisms into a com- 
posite mechanism, it is, in general, essential to use two different keys. Either 
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these two keys together comprise the key for the joint mechanism, or else each 
key is obtained from an underlying one by a key-derivation technique. The first 
possibility increases the key length in the composite mechanism while the second 
involves extra computation at key setup. Both possibilities incur the inefficiency 
of blockcipher re-keying when the combined mode runs. For all of these reasons, 
some new “composite” modes of operation have gone to considerable trouble in 
order to make do (for their particular context) with a single blockcipher key. Ex- 
amples include EAX, CCM, and OCB pU rHUfTT] . Using a single key complicates 
proofs — when the mechanism works at all — because one can no longer reason 
about generically combining lower-level mechanisms. 

Tweakable blockciphers open up a different possibility: the same underlying 
key is used across the different mechanisms that are being combined, but one 
arranges that the tweaks are disjoint across different mechanisms. In this way 
one retains the modularity of design and analysis associated to using separate 
keys — one reasons in terms of generic composition — yet one can instantiate in 
a way that avoids having extra key material or doing extra key setups. Because 
the tweak space for XE and XEX is a Cartesian product of ranges of integers, 
it is easy, for these constructions, to separate the different tweaks. 


8 Combining XE and XEX 

Some blockcipher-based constructions need CCA-security in some places and 
CPA-security in other places. One could assume CCA-security throughout, later 
instantiating all blockcipher calls with a CCA-secure construction, but it might 
be better to use a CPA-secure construction where sufficient and a CCA-secure 
one where necessary. Regardless of subsequent instantiation, it is good to be able 
to talk, formally, about where in a construction one needs what assumption. 

To formalize where in a construction one is demanding what, we tajj each 
blockcipher call with an extra bit. We say that a tweakable blockcipher E: K x 
T x {0, 1}" — > {0, 1}” is tagged if T = {0, 1} X T* for some nonempty set T* . 
Think of T*, the effective tweak space, as the tweak space actually used by the 
mode. The extra bit indicates what is demanded for each tweak. A first bit of 0 
indicates a demand of CPA security, and 1 indicates a demand for CCA security. 
For a given T gT one should be asking for one or the other. 

An adversary A launching an attack on a tagged blockcipher is given two 
oracles, e(-,-) and d(-, ■), where the second oracle computes the inverse of the 
first (meaning d(T,Y ) is the unique X such that e(T. X) = Y). The adversary 
must respect the semantics of the tags, meaning that the adversary may not 
make any query d(T, Y) where the first component of T is 0, and if the adversary 
makes an oracle query with a tweak (6, T*) then it may make no subsequent 
query with a tweak (1 — b, T*). As always, we insist that there be no pointless 
queries: an adversary may not repeat an e(T, X) query or a d(T, Y) query, and 
it may not ask d(T,Y) after having learned Y = e(T,X), nor ask e(T. X) after 
having learned X = d(T,Y). The definition for security is now as follows. 
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Definition 5 (Security of a Tagged, Tweakable Blockcipher). Let E: /Cx 

T x {0, 1}" — > {0, 1}" be a tagged, tweakable blockcipher and let A be an 
adversary. Then Adv~^ prp (A) is defined as Pr [K K. : A® k (ADk(-A => 1] — 
Pr[7r Perm(T, n) : A 7r l , l 7r 1 ('>')=► 1] □ 

Naturally D, above, is the inverse of E. Security in the prp-sense and security 
in the ±prp-sense are special cases of security in the [±]prp sense (but for the 
enlarged tweak space). 

If we combine XE and XEX using our tagging convention we get the tagged, 
tweakable blockcipher XEX*. 

Definition 6 (XEX*). Let E: K. X {0,1}" — > {0,1}" be a blockcipher, let 
a% ,oik e Fjn, and let It, • • • ,Ife C Z. Then E = XEX*[E, a} 1 • • • ajf] is the 
tweakable blockcipher E: K. X ({0, 1} X {0, 1}" x Ii • • • x I*,) x {0, 1}" — > {0, 1}" 
defined by E° K N il '" ifc (M) = E K (M ® A) and E^ N il - ik {M) = E K {M ® A) ® A 
where A = a} 1 alf ■ • • oi£ N and N = Ek (N ) . O 

9 Security of the Combined Construction 

We now specify the security of the XEX* construction. The result encompasses 
that XE is prp-secure and XEX is ±prp-sec.ure. The proof is in [H] , 

Theorem 3 (Security of XEX*). Fix n > 1 and let ai, . . . , a*, G be base 
elements and let fy x • • • xfy be allowed indices such that these parameters provide 
unique representations and such that a} 1 • • • a /= lfor all (ii, . . . , fy) e Ii x • • ■ x 
I k- Fix a blockcipher E: K.X {0, 1}" — > {0, 1}" and let E = XEX*[E, a} 1 • • • cc£}. 
Then Adv^ prp (t, q) < Adv^ prp (t / ,2q) + ■ 9, | n (? where t' = t + ckn(q + 1) for 
some absolute constant c. O 

10 The OCB1 Authenticated-Encryption Scheme 

We recast OCB [15] to use a tweakable blockcipher instead of a conventional 
blockcipher. Liskov, Rivest, and Wagner first did this m , but our formulation 
is different from theirs. First, guided by what we have done so far, we choose 
a tweak space of T = {0, 1} X {0, 1}" x [1 .. 2 n / 2 ] x {0, 1}. The first bit of the 
tweak is the tag; the effective tweak space is T* = {0, 1}" x [1 .. 2"/ 2 ] x {0, 1}. 
Second, we want tweaks to increase monotonically, and so we switch the “special” 
processing done in OCB from the penultimate block to the final block. The 
resulting algorithm is shown in Fig. [T] Algorithm OCB1 is parameterized by a 
tweakable blockcipher E: K x T x {0, 1}" — > {0, 1}" and a number t£ [0 .. n]. 
For clarity, we write 7rf for E l K N,A) and nf for E° Ni0 and vf for E° Nil . 

The security of OCBl[Perm(T, n)] is much simpler to prove than the secu- 
rity of OCB[Perm(n)]. (Liskov, Rivest, and Wagner [10] had made the same 
point for their tweakable-blockcipher variant of OCB.) To state the result we 
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Algorithm OCB1. Encrypt £ (M) 
Partition M into M[ 1] • • • M[m] 
for i € [1 .. m - 1] do C[i] <- 7rf (M[i]) 
Pad <- 7r^(len(M[m])) 


C[m. 

] <- M[m] © Pad 

C+- 

C[l] • • • C[m] 

£f- 

' M[ 1] © • • • © M[r 


C[ra]0* © Pad 

Tag 


T 

Tag [first r bits] 


return C <— C II T 


Algorithm 0CB1. Decrypt^ (C) 

Partition e into C[ 1] • • ■ C[m ] T 

for i e [1 .. m - 1] do M[i] <— (ir? ) -1 (C[i]) 

Pad <— 7T^(len(CH)) 

M[m\ <— Cfm) © Pad 
M <- M[ 1] • • • M[m] 

r <- M[ 1] ® ■ • • © Af[m - 1] © C[m]0* © Pad 
Tag <— 7r^ (£) 

T' <— Tag [first r bits] 

if T = T' then return M 

else return INVALID 


Fig. 1. 0CB1[13, t] with a tweakable blockcipher E: K x T x {0,1}"' — > {0,l} n and 
tweak space T = {0, 1} x {0, l} n x [1 .. 2 n/ ~ \ x {0, 1} and tag length r € [0 .. n]. We 
write nf and nf 1 and nf for E]( N % 0 and E % N ' 0 and E% N * 1 


give a couple of definitions from m- For privacy of a nonce-based encryption 
scheme 77 = (1C, £,T>) we use the notion of indistinguishability-from-random- 
strings, which defines Adv^ lv (A) as Pr[7f 1C : A £k ^' , '' > => 1] — Pr[A®('’ ’) => 1], 
Here $(•,•) is an oracle that, on input (TV, M), returns \M\ random bits. The ad- 
versary is not allowed to repeat a nonce TV. For authenticity we use the nonce- 
based notion of integrity of ciphertexts: the adversary is given an encryption 
oracle £k(-,-) and is said to forge if it outputs an (TV, C) that is valid and 6 
was not the result of any prior (TV, M) query. The adversary is not allowed to 
repeat a nonce TV while it queries its encryption oracle. We write Adv'[} lth (T) for 
Pr [TV •4- /C : A £k ^’~) forges ]. We have the following theorem for the information- 
theoretic security of OCB1. The proof is in [H] . 

Theorem 4 (OCB1 with an Ideal Tweakable Blockcipher). Fix n > 1 . 

r © [0..n], and T = {0,1} x {0,1}" X [1..2"/ 2 ] x {0,1}. Let A be an adver- 
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Algorithm 0CB1. Encrypt^ (M) 
Partition M into M[ 1] • • • M[m] 
A^2 E k (N) 

E^0 n 

for i £ [1 .. m — 1] do 

C[i] <— Ek(M[i\ ffi A) ® A 
A^2A 
E <— E (B M[i] 

Pad <- E K (}en(M[m]) ® A) 

C[m\ «- M[m] ® Pad 
C <- C[l] • • • C[m] 
r <- £ ® C[m]0* ® Pad 
A^3A 

Tag <— E k (E ® A) 

T <— Tag [first r bits] 
return e <- C || T 


Algorithm 0CB1. Decrypt^ (C) 
Partition e into C[ 1] • • ■ C[m ] T 
A *— 2 Ek (IV) 

0" 

for i e [1 .. m — 1] do 

M[i\ «- E^iCli] ® A) ffi A 
A<-2A 
E *— E (B M[i] 

Pad <— Ex(len((7[m]) ® A) 

M[m\ <- C[m] ffi Pad 
M <- M [1] • • • M[m] 
r <- r ® C[m]0* ffi Pad 

Tag <— Ek (E ffi A) 

T' <— Tag [first r bits] 

if T = T' then return M 

else return INVALID 


Fig. 2. 0CB1[E, t] with a conventional blockcipher E: K. X {0, l} n — > {0, l} n 

and a tag length r £ [0..n]. This coincides with OCB1 [E. r] where E = 

XEX[E,2^- 2n/2 h^] 

sary. Then Adv p " v B1[Perni(T n) t] (A) = 0 and Adv^ 1[Perm(r ri)ir] (A) < 2 n ~ r / 
( 2 " — 1 ). □ 

Note that the authenticity bound is close to 2 -T ; in particular, 2 n-T /(2” — 
1) < 1/(2 T — 1) for all t > 2. The bounds do not degrade with the number 
of queries asked by the adversary, the length of these queries, or the time the 
adversary runs. For the complexity-theoretic analog we have the following. 

Corollary 1 (OCB1 with a Tweakable Blockcipher). Fix n > 1, t € 

[0 .. n) , T = {0, 1} x {0, 1}" x [1 .. 2"/ 2 ] x {0, 1}, and E: JCxTx {0, l } n -f {0, 1}" 
a tagged, tweakable blockcipher. T/ien Adv p ” v B ^~ ^(f, <r) < Adv^ rp (t / , a) and 
Adv^^j- (t, a) < Adv^ prp (t', a) + 2 n ~ T /(2 n — 1), where t' = t + cna for 
some absolute constant c. □ 

The proof requires CPA-security for privacy but authenticity uses the notion 
that combines CPA- and CCA-security (Definition [5J|. It is here that one has 
formalized the intuition that the first m — 1 tweakable-blockcipher calls to OCB1 
need to be CCA-secure but the last two calls need only be CPA-secure. 

To realize OCB1 with a conventional blockcipher E: K, x {0, l} 71 — > {0, 1}", 
use XEX*, instantiating OCBl[A, r] by way of E = XEX* [E. 2 I 3 I ] where I = 
[1..2 n / 2 ] and JT = {0,1}. Overloading the notation, we write this scheme as 
OCBl[E, t]. The method is rewritten in Fig. [21 
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Corollary 2 (OCB1 with a Blockcipher). Fixn > 1 and r G [0 .. n] . Assume 
that 2, 3 provide unique representations on [1 .. 2"/ 2 ] x {0, 1} and 2*3 J /= 1 for all 
(i,j) S [1 .. 2"/ 2 ] x {0, 1}. Let E: K. x {0, 1}" — > {0, 1}" be a blockcipher. Then 

~ Adv G<M[B,T](M S Adv^ rp (t / , 2cr) + and 

- (t, a) < Adv^. pip (t' ,2a) H — f 2 n - 1 

where t' = t + cna for some absolute constant c. □ 

Propositions Q] and |2] establish that n = 128 and n = 64 satisfy the require- 
ment for unique representations. They also guarantee that there is no represen- 
tative of 1 within [1 .. 2”/ 2 ] x {0, 1}. To see this, note that the propositions imply 
that (0,0) is the only representative for 1 within a space Ii x I 2 that includes 
[1 .. 2”/ 2 ] x {0,1}, and so there can be no representative of 1 within a subspace 
of Ii x I 2 that excludes (0,0). 

Blockcipher-based OCB1 is more efficient than OCB. With OCB one expects 
to use preprocessing to compute a value L = E K ( 0") and a collection of 2 l L- 
values. This is gone in OCB1; preprocessing is not useful there beyond setting up 
the underlying blockcipher key. Beyond this, with OCB processing the j th block 
involved xoring into the current offset a value L(i) =2 l L where i = ntz(j) was 
the number of trailing zero-bits in the index j. In the absence of preprocessing, 
offset-calculations were not constant time. This too is gone. 

The previous paragraph notwithstanding, the time difference or chip-area 
difference between optimized implementations of OCB and OCB1 will be small, 
since the overhead of OCB over a mode like CBC was already small. The 
larger gain is that the mode is simpler to understand, implement, and prove 
correct. 

11 The PMAC1 Message Authentication Code 

As with OCB, one can recast PMAC [4] to use a tweakable blockcipher and, 
having done so, one can instantiate the tweakable blockcipher, this time with 
the XE construction. The resulting algorithm, PMAC1, is simpler and more 
efficient than PMAC. In the latter construction one had to xor into the cur- 
rent offset a value L(i) = 2 l L where i was the number of trailing zero-bits 
in the current block index j. This is gone in PMAC1, and an implementation 
no longer needs to concern itself with Gray codes, precomputing L(i)-values, 
or finding the most efficient way to bring in the right L(i) value. Details are 
in [Tl]. 

To make an authenticated encryption scheme that handles associated-data, 
combine OCB1 and PMAC1 [13] - Encrypt message M under key K , nonce N, 
and header H by OCB1. Encrypt^ (M) ©PMAClif (H) where the ® xors into the 
end. Omit the ® PMACljf (H) if H = e. We call this scheme AEM. 
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12 Comments 

Under the approach suggested by this paper, to get good efficiency for a design 
that uses a tweakable-blockcipher, the designer must accept certain design rules. 
In particular, the tweak space needs to look like {0, 1}" x MG x SMALL for 
appropriate sets BIG and SMALL, and one needs to arrange that most tweaks 
be obtained by incrementing the prior one. It is a thesis implicit in this work 
that these restrictions are not overly severe. 

Besides simplifying the design and proof for OCB and PMAC, we have im- 
proved their efficiency. The improvement are not large (the modes were already 
highly efficient), but performance improvements, of any size, was not a benefit 
formerly envisaged as flowing from the tweakable-blockcipher abstraction. 

Somewhat strangely, our constructions depend on the relative easiness of 
computing discrete logarithms. I know of no other example where one needs to 
compute discrete logs in order to design or verify a mode of operation. 

I end this paper by acknowledging that everyone writes block cipher, not 
blockcipher. Still, the time has come to spell this word solid. I invite you to join 
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A Tweakable Blockciphers Implicit in Prior Work 

When tweaks increase in sequence, the most efficient constructions formerly 
known for a tweakable blockcipher are those implicit in earlier modes [H[51[!|1[T5] , 
recast in view of Liskov, Rivest, and Wagner [10]. In particular: 

— Jutla [5] might be seen as suggesting a construction (among others) of 
E : (/C x K') x ({0, 1}" x Z+) x {0, 1}” -a {0, 1}" by way of E^,(X) = 
Ek(X ® A) ® A where A = ii mod p and £ = E K i (N) and p is the largest 
prime less than 2". 

- Gligor and Donescu [5] might be seen as suggesting constructions like 
E: (K. X {0, 1}") X [1 .. 2 n - 1] — ► {0, 1}" by E^ ^X) = E K (X + 8) where 
8 = ir and addition is done modulo 2". 
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Rogaway, Bellare, and Black [15] might be seen as implicitly suggesting 
making a tweakable blockcipher E: K, x ({0, 1}" x [0 ..2" -2 ]) x {0, 1}" — *■ 
{0, 1}" from an ordinary blockcipher E: K. X {0, 1}" — ► {0, l} n by way of 
Ek'\ x ) = E k (X © A) ® A where A = %L © R and L = E K ( 0 n ) and 
R = E k (N © L) and 7,; is the i-th Gray-code coefficient. 

Black and Rogaway [1] might be seen as making E: K. X [0..2" -2 ] x 
{0, l} n ->■ {0, 1}” out ofE: ICx {0, 1}" -»• {0, 1}" by %( X) = E K (X®A) 
where A = and L = Ek{ 0 n ) and 7,; is as before. 

The last two definitions ignore the “special” treatment afforded to blocks 
modified by xoring in 2~'L. The implicit intent pH ITS] was to use this 
mechanism to enlarge the tweak space by one bit, effectively taking the 
cross product with {0, 1}. 
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Abstract. Even and Mansour | EM97| proposed a block cipher construc- 
tion that takes a publicly computable random permutation oracle P and 
XORs different keys prior to and after applying P\ C = &2 © P(M ® fci). 
They did not, however, describe how one could instantiate such a per- 
mutation securely. It is a fundamental open problem whether their con- 
struction could be proved secure outside the random permutation ora- 
cle model. We resolve this question in the affirmative by showing that 
the construction can be proved secure in the random function oracle 
model. In particular, we show that the random permutation oracle in 
their scheme can be replaced by a construction that utilizes a four-round 
Feistel network (where each round function is a random function oracle 
publicly computable by all parties including the adversary). Further, we 
prove that the resulting cipher is super pseudorandom - the adversary’s 
distinguishing advantage is at most 2q 2 /2 n if he makes q total queries to 
the cipher, its inverse, as well as any random oracles. Even and Mansour, 
on the other hand, only showed security against inversion and forgery. 
One noteworthy aspect of this result is that the cipher remains secure 
even though the adversary is permitted separate oracle access to all of 
the round functions. One can achieve a two-fold and four-fold reduction 
respectively in the amount of key material by a closer inspection of the 
proof and by instantiating the scheme using group operations other than 
exclusive-OR. On the negative side, a straightforward adaption of an ad- 
vanced slide attack recovers the 4n-bit key with approximately \/2 ■ 2 n 
work using roughly \[2 ■ 2” known plaintexts. Finally, if only three Feis- 
tel rounds are used, the resulting cipher is pseudorandom, but not super 
pseudorandom. 


1 Introduction 

The Even-Mansour Construction. Even and Mansour |EM97| proposed a 
block cipher construction based on XORing secret key material just prior to 
and just after applying a random permutation oracle P: C = k ,2 © P{M 0 k\), 
where M is the plaintext, C is the ciphertext, and k\ . k -2 is the key material. 
The permutation P (as well as its inverse P _1 ) is computable by all parties, 
including the adversary (see fig. [TJ) . Even-Mansour proved that a polynomial- 
time adversary with black-box query access to the cipher and its inverse, as well 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
© Springer- Verlag Berlin Heidelberg 2004 
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as black-box query access to the internal permutation and its inverse cannot 
invert an un-queried ciphertext of his choice, except with negligible probability. 
They also proved an analogous result about computing the cipher’s forward 
direction. 

While there are practical limitations to their construction |Dae911lBW00j . the 
Even-Mansour work is well known and theoretically interesting. In particular, 
it is an example of a cipher for which an adversary has black-box access to the 
only real “cryptographic” component; i.e., the random permutation oracle. The 
only secrets are simply XORed at the beginning and the end, and everything 
else is publicly accessible. 

Fundamental Open Problems. The Even-Mansour work may be described 
within the framework of the random-oracle model |BR93] in which their cipher 
makes use of a random permutation oracle. Naturally, the need for such a permu- 
tation oracle is unpleasant, especially since Even and Mansour did not indicate 
how one might instantiate such a random permutation oracle while maintaining 
security. This motivates the following problem: 

Open Problem 1: How can one go about instantiating the random permutation 
oracle in the Even-Mansour scheme? 

Furthermore, Even and Mansour only proved security against inversions and 
forgeries. However, for block ciphers, the current bar is to prove super pseudoran- 
domess |LR88| . That is, the cipher should be indistinguishable from a randomly 
chosen permutation on the same message space even if the adversary is granted 
black-box access to the forward and inverse directions of the cipheo This mo- 
tivates a second problem: 

Open Problem 2: Can one prove that an Even-Mansour type construction 
yields a super pseudorandom permutation? 

Our Contributions. We address the first question by demonstrating that 
the random permutation oracle can be replaced by a construction involving 
random function oracles; i.e., the underlying oracle (which must be accessible to 
all parties) does not have to be bijective, but we construct a permutation using 
it that is bijective. By supplanting the use of random permutation oracles by 
random function oracles, we have a result based on a less restrictive model. Our 
construction uses a Feistel ladder in which the random function oracle is used 
as a round function (see fig. HJ . However, what is different in this setting is that 
the adversary not only has access to the forward and reverse directions of the 
cipher, but also to each of the individual round functions. 

We address the second problem by proving that the construction is super 
pseudorandom. We remark the one can construe the Kilian-Rogaway analysis 


Their is also a notion of pseudorandomness for block ciphers wherein the adversary 
must distinguish it from a random permutation given black-box access to only the 
forward direction of the cipher. 


34 


C. Gentry and Z. Ramzan 



Fig. 1 . The diagram on the left depicts the Even-Mansour scheme where P is a 
random permutation oracle; i.e., the adversary has black-box access to P and P -1 . 
The diagram on the right depicts our scheme in which the permutation oracle is 
instantiated by a Feistel network consisting of publicly-accessible random function 
oracles f, g 


of DESX |KR96] as a proof that Even-Mansour is pseudorandom. Recall that 
in DESX, the Even-Mansour random permutation is supplanted with a keyed 
block cipher, such as DES. The Kilian-Rogaway proof allowed the adversary 
oracle access to the internal permutation P (modeled as an ideal block cipher) 
as well as P _1 , to simulate that an adversary had correctly guessed the key - 
this maneuver isolates the benefits of the pre- and post-whitening keys. However, 
in their published proof the adversary was not given access to the inverse of the 
block cipher - so super pseudorandomness was not provecd- 

In addition, Ramzan-Reyzin |RR00| noted that one could use their round se- 
curity framework to prove that Even-Mansour is super pseudorandom, but their 
focus was different, so no proof was supplied. Also their comment was limited to 
the original Even-Mansour construction (which used the random permutation 
oracle). Therefore, we consider addressing the first fundamental open problem 
as our main technical contribution; a side benefit of our work is a proof of super- 
pseudorandomness for Even-Mansour style block ciphers. 

Our results help us better understand block cipher design. First, they point 
to the benefit of pre- and post- whitening. In particular, our construction shows 
that, in the random function oracle model, one can construct a super pseudo- 
random block cipher in which the all key material is only incorporated during 
the pre- and post-whitening phases and in a very simple way. This is despite 
the fact that the adversary has access to the internals of the cipher. Second, our 
constructions show that it may be possible to obtain a middle ground between 


2 Kilian and Rogaway mentioned that one could extend their proof to address chosen 
ciphertext queries, however, they did not provide the proof, nor did they state a 
formal security theorem where such access is given. 
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pure black-box analysis and one in which an adversary has some meaningful 
knowledge about the internal design of the black box. This can be thought of 
as a “gray-box” analysis. We also remark that the random permutation oracle 
model seems less appealing than the random function oracle model. Instantiat- 
ing a random function oracle while maintaining security seems more plausible 
since such functions could be made sufficiently complex that their behavior is 
ill understood. On the other hand, when instantiating a random permutation 
oracle with an actual permutation, one is limited in the complexity of the de- 
sign since the function must remain bijective and efficient to invert. Our results 
give hope that one may be able to base future cryptosystems on random permu- 
tation oracles and replace them with constructions based on random function 
oracles in a provably secure way. Finally, our work helps bridge the gap between 
the theory and practice of Feistel ciphers. In particular, the theoretical work 
on Feistel ciphers (e.g., [LRS8j 1 considers round functions that are strong (e.g., 
pseudorandom) and potentially complex keying mechanisms (e.g., the functions 
themselves are keyed). This departs from practice in two ways. First, round func- 
tions in practice are weak. Second, block cipher round keys are introduced in 
some simple way, for example by XORing them prior to applying an un-keyed 
function (c.f., DES |FIPS46| h Our work sits somewhere in between since it con- 
siders complex round functions (random oracles), but simple keying procedures 
(XORing). Therefore, we can view our work as providing better mathematical 
insight into the security of DES-like ciphers. 

Other Results. Our proof of security holds even if the amount of key material 
is reduced twofold. Also, if we permit group operations other than XOR, we can 
recycle keying material, yielding a fourfold reduction; interestingly, if XOR is 
used with recycled keying material, the cipher behaves like an involution and 
is trivially distinguishable from a random permutation. This idea of consider- 
ing different group operations has previously been applied to Luby-Rackoff ci- 
phers |PR.S02| . On the negative side, a “sliding with a twist” attack [BWflfl| 
allows an adversary to recover the key using \/2 ■ 2 n known plaintexts and 
\J 2 ■ 2" work. Finally, if we instantiate the permutation with three Feistel rounds, 
the construction is pseudorandom, but is not super pseudorandom. The attack 
adapts the standard distinguisher for three-round Luby-Rackoff ciphers [LR88] . 
Due to space constraints, as well as the fact that these results follow easily from 
existing techniques, we omit a further discussion. For details, see the full version 
of the paper |GR04| . 

Caveat(s) Emptor. While the random-oracle model is an extremely useful 
cryptographic tool, there are instances of schemes that are secure in the random 
oracle model, but are insecure for any instantiation of the random oracle by a 
polynomial-time computable function |GGH981IGK031lBBP04] . We further note 
that the lower bounds we present indicate that n should be chosen so that 2"/ 2 
is sufficiently large to thwart distinguishing attacks. We also remark that Even 
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and Mansour gave a 0(2~ n ) upper bound on the adversary’s success probabil- 
ity, whereas our bound resembles 0{ 2 - "/ 2 ). However, Even and Mansour only 
proved security against inversions and forgeries whereas we show super pseudo- 
randomness. Moreover, we eliminate the random permutation oracle requirement 
and also give the adversary access to the innards of the cipher. Therefore, we 
expect there to be a sizeable gap in the respective security guarantees. In light of 
these caveats, we stress that our main contribution is in resolving fundamental 
issues from the Even-Mansour work and gaining more theoretical insight into 
block cipher design; we do not recommend this as a practical approach to build- 
ing a block cipher. In fact, efficient random oracle model based block ciphers are 
desired, then Ramzan and Reyzin have a four-round Feistel block cipher con- 
struction in which the middle two rounds use a random oracle, and the outer 
two rounds involve universal hash functions |RR00] . 

Organization. Section [2] reviews prior definitions and constructions. Section[3] 
discusses our main construction and security proof. Finally, we make concluding 
remarks in Section H) 


2 Prior Definitions and Constructions 

We describe definitions and prior constructions that are germane to our work. We 
avoid asymptotic analysis in favor of the “concrete” (or “exact” ) security model 
as laid out by Bellare, Kilian, and Rogaway |BKR94j . and Bellare, Canetti, 
Krawczyk |BCK96j . However, our results can be adapted to either model. 

Notation. For a natural number n, we let /„ denote the set of bit strings of 
length n: {0, 1}". For a bit string x, we let |a;| denote its length. If |a;| is even, then 
x L and x R denote the left and right halves of the bits respectively; we sometimes 
write x = (x L ,x R ). If x and y are two bit strings with \x\ = \y\, we denote by 
x®y their bitwise exclusive OR. If S' is a probability space, then x <— S denotes 
the process of picking an element from S according to the underlying probability 
distribution. Unless otherwise specified, the underlying distribution is assumed 
to be uniform. By a finite function (or permutation) family T , we denote a set of 
functions with common domain and common range. Let Rand^~** be the set of 
all functions going from Ik to It, and let Perm 7 " be the set of all permutations on 
I m . We call a finite function (or permutation) family keyed if every function in 
it can be specified (not necessarily uniquely) by a key a. We denote the function 
given by a as /„ . We assume that given a, it is possible to efficiently evaluate f a 
at any point (as well as f~ x in case of a keyed permutation family). For a given 
keyed function family, a key can be any string from I s , where s is known as “key 
length.” (Sometimes it is convenient to have keys from a set other than we 
do not consider such function families simply for clarity of exposition, but our 
results continue to apply in such cases.) For functions / and g, g o f denotes the 
function x > -g(f(x)). 
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Model of Computation. We model the adversary M as a program for a Ran- 
dom Access Machine (RAM) with black-box access to some number k of oracles, 
each computing some specified function. If (/i, . . . , f k ) is a fc-tuple of functions, 
then A^ 1 ’ "’^ denotes a fc-oracle adversary who is given black-box oracle access 
to each of the functions /i, . . . , We define M’s “running time” to be the num- 
ber of time steps it takes plus the length of its description (to prevent one from 
embedding arbitrarily large lookup tables in M’s description). 

Pseudorandom Functions and Block Ciphers. The pseudorandomness of 
a keyed function family T with domain I k and range If captures its compu- 
tational indistinguishability from Rand fe ^. The following definition is adapted 
from |GGM84] : 

Definition 1. A pseudorandom function family IF is a keyed function family 
with domain I k , range If, and key length s. Let A be a 1-oracle adversary. Then 
we define A ’s advantage as 

Advf^M) = |Pr[o £ I s : A fa = 1] - Pr[/ £ Rand fe ^ : A f = Ijt . 

For any integers q,t > 0, we define Ad \/^(q,t) = max^{Adv^ f (M)}, as an 
insecurity function, where the maximum is taken over choices of adversary A 
such that: 

— A makes at most q oracle queries, and 

— the running time of A, plus the time necessary to select a<— I s and answer 
A 's queries, is at most t. 

Recall that the Even-Mansour cipher |EM97] operates on a 2n-bit string x 
as follows E(x) = &2 ® P(x ® hi) where fci ,&2 G hn constitutes the keying 
material and P is a random permutation oracle. Here P and P _1 are publicly 
computable (in a black-box fashion) by all parties. Even and Mansour proved 
that E is hard to invert on a point Co of the adversary’s choice even if the 
adversary has oracle access to E, F _1 , P, P _1 subject to the restriction that the 
adversary cannot query the E~ l oracle on the point Co; i.e., it is hard to find Mq 
such that Mo = (Co). Similarly, they showed that the adversary cannot 

compute the ciphertext corresponding to a message point Mo of its choice with 
access to these same oracles, but this time subject to the restriction that the 
adversary cannot query the E oracle on point M 0 ; i.e., it is hard to find Co 
such that Co = E kltk2 (M 0 ). While these results capture some of the security 
requirements needed for a block cipher, there are stronger notions of security 
for a block cipher. One such notion, proposed by Luby and Rackoff [LR88j . 
is called super pseudorandomness. The notion captures the pseudorandomness 
of a permutation family on If in terms of its indistinguishability from Pern/, 
where the adversary is given access to both directions of the permutation. In 
other words, it measures security of a block cipher against chosen plaintext and 
ciphertext attacks. We now describe such notions and how to achieve them. 
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Definition 2. A block cipher V is a keyed permutation family with domain and 
range If, and key length s. Let A be a 2-oracle adversary. Then we define A’s 
advantage as 

Adv^ prp (^) £ |Pr[o £ I s : A = 1] - Pr fp £ Perm 1 : A™' 1 = 1] | . 

For any integers q,t>0, Ad v^ rp (q r , t) specifies the insecurity function (anal- 
ogous to Definition QP. 

Luby and Rackoff showed how to construct a secure block cipher using Feistel 
permutations. 

Definition 3 (Basic Feistel Permutation). Let IF be a function family with 
domain and range I n . Let f £ IF. Let x = ( x L , x R ) with x L ,x R £ I n . We denote 
by f the permutation on I 2n defined as f{x) = ( x R , x L ® f(x R )). Note that it is a 
permutation because f~ 1 (y) = (y R ® f(y L ),y L )- Similarly, let IF = {/ | / £ IF}. 

Definition 4 (Feistel Network). If fi , . . . , f s are mappings with domain and 
range I n , then we denote by $(fi, ■ ■ ■ , f s ) the permutation on I 2n defined as 

Theorem 1 (Luby- Rackoff ). Let h\,f\,f 2 ,h 2 be independently-keyed func- 
tions from a keyed function family F with domain and range I n and key space 
I s . Let V be the family of permutations on l 2 n with key space Ia s defined by 
V = <£(hi, /i, f 2 , h 2 ) (the key for an element ofV is simply the concatenation of 
keys for h\,f\,f 2 , h 2 ). Then, Adv^ rp (<?, t) < Ad v£ f (g, t) + (|) ( 2~ n+1 + 2~ 2n+1 } . 

The Luby-Rackoff result proved security when the adversary has access to the 
permutation and its inverse. In our case, we will show security of the Even- 
Mansour cipher when the adversary has black-box access to the cipher, its in- 
verse, and to each of the internal round functions. 

Having presented the classical definitions of block ciphers and Feistel net- 
works, we now describe notions of the Ramzan-Reyzin round security frame- 
work |RR00| which we make use of in the present work. 

Definitions (Round Decomposition |RROO ] ) . Let V, F 1 , IF 2 , . . . , !F r be 

keyed permutation families, each with domain and range If and key length s, 
such that for any key a £ I s , p a = fa ° " ' ° fa- Then F 1 , ■ . ■ , F r is called an 
r-round decomposition for V. For i < j, denote by (i — > j ) a the permutation 
fl° ■■■° fa, and by (i <— j) a the permutation (/^ o . . . o /*) . Denote by i — > j 

and i <— j the corresponding keyed function families. 

Note that having oracle access to a member of i — » j means being able to give 
inputs to round i of the forward direction of a block cipher and view outputs 
after round j. Likewise, having oracle access to i *— j corresponds to being able 
to give inputs to round j of the reverse direction of the block cipher and view 
outputs after round i. Thus, the oracle for 1 — > r = V corresponds to the oracle 
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for a chosen plaintext attack, and the oracle for 1 <— r = R _1 corresponds to 
the oracle for a chosen ciphertext attack. 

We now give a formal security definition of a block cipher when an adversary 
has access to internal rounds. Note that the adversary is allowed oracle access 
to some subset K of the set {i — ► j, i *— j : 1 < i < j < r}, and the insecurity 
function additionally depends on K. 

Definition 6 (Round Security [RROO] 1. Let V be a block cipher with domain 
and range I key length s, and some r-round decomposition W , . . . , T r . Fix 
some subset K = {7T 1 , . . . , w k } of the set {i — > j,i <— j : 1 < i < j < r}, and let 
A be a k + 2-oracle adversary. Then we define A’s advantage as 

|Pr[a £- I s : A p °' p « = 1] - Pr[p £ Pern/, a £ I s : A ^ = 1] | 

For any integers q,t> 0 and set K, Ad j- T K (q,t ) specifies our inse- 
curity function (analogous to Definition UJ). 

Ramzan and Reyzin jRROO] were the first to consider what happens when 
internal round functions of a Feistel network are available to an external adver- 
sary. 

Theorem 2 (Ramzan- Reyzin). Let f\ . / 2 , fi : fi be independently-keyed func- 
tions from a keyed function family T with domain and range I n and key space 
I s . Let V be the family of permutations on I 2n with key space Ia s defined by 
V = #(/i , f ‘2 , /, 3 , f' 4 ) with the natural f-round decomposition T, J- , F, T . Let 
K — {i —■ ► j, i <— j : 2 < i < j < 3}. Then 

Ad ^---- K (q, t) < Ad v¥(q, t) + Q (2-+ 1 + 2“ 2 " +1 ) + q 2 (2— 1 ) . 

Ramzan-Reyzin consider the case where all parties have black-box access to 
the internal permutations / 2 ,/ 3 - They noted that if the underlying round func- 
tions / 1 , and f^ are chosen from Rand n_m , then one could translate their results 
to the random oracle model wherein / 2 , f^ are modeled as random function or- 
acles that are accessible to all parties, including the adversary. 

3 Our Main Result 

We now prove our main result. We use the Ramzan-Reyzin round-security frame- 
work |RR00] to analyze our construction and leverage their techniques to obtain 
the desired result. However, for technical reasons, the proof must also incorpo- 
rate an additional hybrid distribution into the argument. Now, let denote 

the Even-Mansour construction when the internal permutation is replaced by a 
four-round Feistel network with outer round function g and inner round func- 
tion f- HifoW = fc 2 e &(g, f, f,g)(x © h). Here fci, k 2 e I 2n are the keys and 
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/, g axe modeled as random function oracles; i.e., they are publicly accessible to 
all parties (including the adversary) and behave like random functions. Observe 
then that the adversary can compute not only the Even-Mansour permutation, 
but also knows its internal structure and has black-box access to the functions 
/ and g around which it is designed. We view this construction as consisting of 
the composition of six round permutations: 

- 7 Ti 1 {x) = X®k\ _ _ 

- 77.3,774 = /. Recall that / denotes a permutation on I 2n defined as f(x) = 
(x R ,x L ® f(x R )). 

- 7T2, 7T5 = g. 

- n 6 2 (x) = x®k 2 . 

Observe that (M) = n^ 2 o 7T5 o ■ ■ ■ o n 2 o sr* 1 . We now state our main 

result in the following theorem: 

Theorem 3 (Main Result). Suppose K C {* — > j,i <— j | 2 < i < j < 5}. 
Let f be modeled as a random oracle, and let k\ and k 2 be picked randomly and 
independently from I 2n . Let = k 2 ® <h(g, f, f,g)(x ffi fci), and R be a 

random permutation on I 2n . Then 

Ad 4 P ™,..,vr 6 fe« < (25 2 - q) ■ 2-" + Q ■ 2 _2 " +1 . 

Observe that we do not consider any terms of the form Ads/ P f f (q. t) since we 
assume that the underlying round functions are modeled as random oracles in 
which case such terms will evaluate to 0. 

Recasting the problem in the round-security framework allows us to apply 
the techniques of Ramzan and Reyzin |RR00| (who generalized the techniques 
of Naor and Reingold |NR99| to deal with the extra queries from an oracle with 
internal access). We note that access to the oracles of K is equivalent to access 
to the oracles for / and Now, consider the following theorem. 

Theorem 4. Let f and g be modeled as random oracles, and let ki and k 2 be 
picked randomly and independently from I 2n . Let (a;) = k 2 ®<l>(g, /, /, g)(a;© 
hi), and let R be a random element of Perm 2 ". Then, for any 4-oracle adversary 
A (we do not restrict the running time of A) that makes at most q c queries to 
its first two oracles (either or R,R _1 ) and at most q 0 f and q og queries 

to its second two oracles (f and g) respectively, it follows that: 

|Pr [A*’*~ 1J ’ B = 1] - = 1]| 

< {ql+2q 0 fq c +2q og q c +ql — q c )2 "+^^(2-2 n +2 2 " +1 ) . 


3 We remark, however, that one query to an oracle in K may need to be simulated by 
multiple queries to f,g. Therefore, the total number of queries made to / and g is 
an upper bound on the number of queries that would need to be made to an oracle 
in K. 
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Observing that the total number of queries q = q c + q () f + q og , it is straight- 
forward to see that 

(Qc + 2 Qofq c + 2q og q c + q 2 c ~ q c ) < 2y 2 - q. 

Therefore, we see that theorem [7] implies theorem^ In the sequel, we describe 
the proof of theorem HJ The first part of the proof focuses on the adversary’s 
transcript (i.e., his “view”) and shows that each possible transcript is about as 
likely to occur when A is given P, /, g as when A is given R, /, g. This part of the 
proof also relies on a hybrid distribution # to facilitate the proof. The second 
part uses a standard probability argument to show that if the distributions on 
transcripts are similar, then A will have a small advantage in distinguishing P 
from R. 

Proof of Theorem m To start with, let P denote the permutation oracle 
(either or R) that A accesses. From now on, for notational convenience we 
ignore the superscripts /, g and the subscripts k% , k% associated with >F. Let 
and O 9 denote the oracles that compute the functions / and g (note that when A 
gets as its permutation oracle, / and g are actually used as the round function 
in the computation of the oracle P = <F; when A gets R as its permutation 
oracle, / and g are independent of P = R). The machine A makes two types of 
queries to the oracle P: (+, x) which asks to obtain the value of P(x ), or (— ,y ) 
which asks to obtain the value of P _1 (y) - where both x and y are in l‘ ln - We call 
these cipher queries. We define the query-answer pair for the i th cipher query as 
(xi, yi) 6 I-in x Pin if -A’s query was (+, Xi ) and y-i is the answer it received from P 
or its query was (— , y,) and x% is the answer it received. We assume that A makes 
exactly q c cipher queries and we call the sequence {(x\. y\), ... . (x qc ,y qc )}p the 
cipher- transcript of A. In addition, A can make queries to and O 9 . We call 
these oracle queries. We denote these queries as: (0* ,x') ( resp . (O 9 ,x')) which 
asks to obtain f(x') (resp. g(x')). We define the query-answer pair for the i th 
oracle query as (x', y'} e I n x I n if *4’s query was (O f ,x') and the answer it 
received was y' and as (x",y") G /„ x I n if A’s query was (0 9 ,x") and the 
answer it received was y" . We assume that A makes q a f and q og queries to 
0? and O 9 respectively. We call the sequence { (x'j , y( ) , . . . , ( x ' qof ,y' qof )}of the 
/-oracle-transcript of A and {{x'{, y"), . . . , (x" qo , y" o )}o» the y-oracle-transcript 
of A. Note that since A is computationally unbounded, we can make the standard 
assumption that A is a deterministic machine. Under this assumption, the exact 
next query made by A can be determined by the previous queries and the answers 
received. We formalize this as follows: 

Definition 7. We denote the i + j + k + 1 st query A makes as a function of 
the first i + j + k query-answer pairs in A ’s cipher and oracle transcripts ( where 
either i < q c or j < q a f or k < q og ) by: 

CA[{(xi,yi), • • • , (xi,yi)}p, • • • . (^3,y'j)}oi,{(p>niVi), • • • , (xk,y'k)}os]- 
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For the case that all queries have been made (i.e., i = q c ,j = q 0 f,k = q og ), 
we define the above expression to denote A ’s output as a function of its cipher 
and oracle transcripts. 

Definition 8. Let a = ( Tp,Tf,T g ) be a three tuple comprising the sequences 
T P = {{x\,y \), . . . , {x qc ,y qc )}p, T f = {(x'^y'fi ), . . . , {x' qof ,y’ qof )} 0 f, and T g = 
{{x'{,y "), . . . , (x'g o ,y'g o )}oo, and where for 1 < i < q c we have that {xi,yf) G 
Lin x h n, for 1 < j < q a f, we have that (x'j,y'j) G I n x I n , and for 1 < k < q og , 
we have that (x'f., y'f.) G I n x I n . Then, a is a possible A-transcript if for every 
1 < i < q c , for every 1 < j < q 0 f and for every 1 < k < q og , 

Ca[{(xi,vi), ■ • • , • • > ( x 'j,yj)}of{(x">yi), • • • > (xk,y'k)}o9] e 

{(+, x i+1 ), (-, w+0, (Of, x' i+1 ), (o\ 4Vi)}- 

We now consider two useful processes for answering ,4’s cipher queries. 

Definition 9. Let F denote the process in which the cipher queries and f -oracle 
queries are answered as they would be for L>, however the g-oracle queries are 
answered by another independent random function oracle h. 

Definition 10. Let R denote the process that answers all oracle queries as T 
would, but answers the i th cipher query of A as follows: 

1. If A’s query is ( +,Xi ) and for some 1 < j < i the j th query-answer pair is 
(xi,yi), then R answers y,. 

2. If A’s query is (— ) and for some 1 < j < i the j th query-answer pair is 
( Xi,y, ), then R answers x 

3. If neither of the above happens, then R answers with a uniformly chosen 
element in l 2 n - 

We formalize the fact that R’s answers may not be consistent with any func- 
tion, let alone any permutation. 

Definition 11. Let a' = {(xi,yi ), . . . , (x qc ,y qc )}p be any possible A-cipher 
transcript. We say that o’ is inconsistent if for some 1 < j < i < q c the corre- 
sponding query-answer pairs satisfy x , = Xj but yi f=yj, or x, f=Xj but y * = yj. 
Likewise, we call any A-transcript a that contains o’ inconsistent. 

Note 1. lfa= ( T P , Tf, T g ), with sub-transcripts T P = {(aq, y\), . . . , (x qc ,y qo )}p, 
T f = , ( x ' qof ,y qof )}of , and T g = {(x'(,y'f), ..., (x'' og , y qog )}os, is a 

possible ^4-transcript, we assume from now on that if a is consistent and if i f=j 
then Xi f=Xj, yi f=yj, x\ f= x ' rj , and x" f=x". This formalizes the concept 
that A never repeats a query if it can determine the answer from a previous 
query-answer pair. 

Fortunately, the process R often behaves like a permutation. It turns out 
that if A is given oracle access to either R or R. to answer its cipher queries, it 
will have a negligible advantage in distinguishing between the two. Proposition Q] 
states this more formally. Before doing so, we first consider the distributions on 
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the various transcripts seen by A as a function of the different distributions on 
answers it can get. 

Definition 12. The discrete random variables TV, T^.Tp, denote the cipher 
and oracle transcripts seen by A when its cipher queries are answered by P , P, 
R, R respectively, and its oracle queries are answered by O f or O 9 . 

Remark 1. Observe that according to our definitions and assumptions, A?' 9 ' ’^’ 9 
and GA{T,js) denote the same random variable. The same is true for the other 
discrete random variables. 

Proposition 1. |Pr ft [CU(T*) = 1] - Pr«[CU(T fl ) = 1]] < (*•) • 2“ 2 ". 

The proof of this proposition has appeared in numerous places [NR991IRR00] . 
The idea is to observer that T R , T ^ have the same distribution conditioned on 
being consistent. One can then boimd the probabihty that is inconsistent 
by ( 9c ) • 2 -2 ”. The proof can be completed by a standard probability argument. 
We omit the details, though they are available in the full version |GR04j . We now 
proceed to obtain a bound on the advantage that A will have in distinguishing 
between TV and T^. We first show that TV and are identically distributed, 
unless the input to g in a cipher query related to P matches the input to g in 
an oracle query related to P. We can compute the likelihood of such an event as 
a function of only k\ and fc 2 - we term this event BadG and define it next; we 
then compute the probability that it occurs. 

Definition 13. For every specific pair of keys Aq, fc 2 € hn, we define BadG(Aq, A; 2 ) 
to be the set of all possible and consistent transcripts a = ( Tp , Tf, T g ), with sub- 
transcripts T P = {(aq, t/i), . . . , (x qc ,y qc )}p, T f = {(x'^y’f ), . . . , {x' qo/ ,y' qof )} 0 f , 
and T g = {(x'{,y '{), . . . , {x gg ,y” o )}e> 9 satisfying at least one of the following 
events: 

- BG1: there exists 1 < i < q c , 1 < j < q og such that xf ® fcf = x", or 

— BG2: there exists 1 <i<q c , 1 < j < q 0 g such that yf © kf = x". 

Proposition 2. Let k\ . k^ be randomly and independently chosen from 1-m ■ For 
any possible and consistent A — transcript a = (Tp,Tf,T g ), with sub-transcripts 
Tp = {(xi,yi),...,(x qc ,y qc )} P , T f = {(x l 1 ,y {), . . . , (x' qof ,y' qof )} 0 f, and T g = 
y"), • • • , { x q og i Uq og ) }oe , we have that 

^Pr [t j e BadG(fci, fc 2 )] < 2 q og q c • 2 _ ". 

Proof. (Sketch) A transcript a is in BadG(fci, kf) if one of BG1 or BG2 occur. 
We obtain an upper bound on the probabilities of each of these events separately 
by using the fact that Aq, are chosen uniformly at random from T 2ri . Applying 
the union bound to stun the individual probabilities yields the desired result. 

We now show that TV and are identically distributed if neither BG1 nor 
BG2 occur. 
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Lemma 1. Let a = (T P ,Tf,T g ), where T P = {(x\,y \), . .., (x qc ,y qc )}p, Tf = 
, (x' qof ,y' qof )}of , and T g = {(x'{, y '{), . . . , (x'' og ,y'' og )} 0 9 , be any pos- 
sible and consistent A — transcript, then 

Pr[IV = a\a BadG(fci, fo)] = P_r[T£ = a]. 

Proof. (Sketch) Observe that xf ® kf f= x" and yf ® kf f= x" for all i,j 
whenever a ^ BadG(fci , hi). In such a case, the inputs to g during the cipher 
queries are distinct from the inputs to g during the 5-oracle queries. Since there 
is no overlap in the two sets of queries, since g is modeled as a random oracle, 
and since the events depend only on the choice of k\ and k -2 (which are chosen 
independently of g), the distribution is identical to one in which g is replaced by 
another independently chosen random oracle h. 

We now focus on T$. It turns out that and r Ifi are identically distributed 
unless the same value is input to the inner random oracle / on different oc- 
casions (we show this in Lemma [2]). We can compute the likelihood of this 
event as a function of only k \ , k- 2 , and g. We call this event “Bad” (in the next 
definition) and obtain a bound on the probability that it actually occurs (in 
Proposition [3} . 

Definition 14. For every specific pair of keys k\ , fcg G l 2 n and oracle g G 
Rand n_> ", define Bad (Aq, £2,5) to be the set of all possible and consistent tran- 
scripts a = ( T P ,T f ,T g ), with sub-transcripts T P = {(xi,yi), . . . ,(x qc ,y qc )}p, 
T f = > ( x q of ,y'q of }}of, and T g = {{x'{,y'{), ..., {x'' og ,y qog )}c>9, sat- 

isfying at least one of the following events: 

- Bl: 3 1 <i < j <q c such that g{xf ® kf) ® xf = g(xf ® kf) ® xf 

- B2: 3 1 <i < j <q c such that yf ® g(yf ® kf) = yf ® g(yf ® kf) 

- B3: 3 1 < i, j < q c such that g(xf ® kf) ® xf ® kf = kf ® yf ® g(yf ® kf) 

- B4: 3 1 < i < q C) 1 < j < q 0 f such that g(xf ® kf) ffl xf ffl kf = x'- 

- B5: 3 ll < * < q c , 1 < j < q Q f such that k 2 ® yf ® g{yf ® kf) = x'-. 

Proposition 3. Let ki,k 2 be randomly and independently chosen from l 2 n - 
Then, for any possible and consistent A — transcript a = ( T P ,Tf,T g ), with sub- 
transcripts T P = {(x 1 ,y 1 ),...,(x qc ,y qc )} P , T f = {{x^y'f), . . . , (x' qof ,y qof )} 0 f, 
and T g = {( x",y "), ... , ( x" qo ,y” o )}o», we have that 

kFk 2 g? e Bad ( fcl ’ fc 2>s)l < (<ic + 2 qofq c + 2 • (2°)) ' 2 ~ n - 

Proof. (Sketch) Recall that a transcript a G Bad(Aq , Aq, 5) if at least one of 
the above events occurs. We obtain an upper bound on the probabilities of 
each of these events separately using the fact that k\, k/ 2 are chosen uniformly at 
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random from l 2 n and that g is chosen uniformly at random from Rand” - *". Ap- 
plying the union bound to sum the probabilities for each event yields the desired 
result. 

Lemma 2. Let a be defined as in Lemma\J\ Then, 

Pr [T* = crlcr £ Bad (fci, fc 2 , <?)] = Pr[T^ = a], 

R 

Proof. It is easy to see that Pr^jT^, = cr] = 2~ ( - 2qc+q °f +q °^ n (following an argu- 
ment in |NR.99| . |RR00| 1 . Now, fix ki,k 2 ,g to be such that cr ^ Bad(fci, k 2 ,g). 
We will now compute Pr f,h[T$, = cr] (recall that in the definition of L/, h is a 
random oracle independent of / and g, and note that the probability is now 
only over the choice of / and h). Since a is a possible A-transcript, it follows 
that = a if and only if y t = k\ ® 'L(g, /, /, g){xi ® fc 2 ) for all 1 < i < q c , 
y'j = f{ x j)i for all 1 < j < q a f, and y" = g(x") for all 1 < j < q og . If we define 
Si = kf © xf ® g{xf ® kf) and Tj = kf ® yf ® g(yf ® k%), then 

(»f, yf - ) = &(xf,xf) f(Si) ® fcf = Ti® xf and f(Tf) © kf = yf © 

Now observe that for all 1 < i < j < q c , Si f= Sj and Tj f= Tj (otherwise 
a G Bad(A,'i, A, J 2 , //)). Similarly, for all 1 < i,j < q c , Si f=Tj. In addition, it follows 
again from the fact that a £ Bad(fc-i , k-i.g) that for all 1 < i < q c and 1 < j < q og , 
x'i f=Sj and x\ f=Tj. So, if cr ^ Badffci , k/i.y) all the inputs to / are distinct. Since 
/ is modeled as a random oracle, Pr^/JT^ = cr] = 2~( 2qc+q °f +q °^ n (the cipher 
transcript contributes 2~ 2nqc and the oracle transcripts contribute 2 - q °f n ~ q °9 n to 
the probability). Thus, for every choice of k\,k 2 ,g such that cr (f Bad(/ci, k 2 ,g), 
the probability that T# = a is exactly the same: 2 -( 2qc + q °f+ q °9) n . Therefore: 
Pr # [T^ = cr|cr ^ Bad(fc 1; A? 2 , 5 )] = 2~( 2q °+ q °f+ q °^ n . 

The rest of the proof consists of using the above lemma and Propositions [1] [2] 
and|3j as well as Lemmas [Hand El in a probability argument. The idea is to first 
express the adversary’s advantage as a function of how its distinguishing machine 
behaves on specific transcripts. Then, these probabilities are re-expressed to 
incorporate the conditions Bad and BadG. By basic manipulation of probabilities, 
we can show that the adversary’s advantage is bounded above by the probability 
of the conditions Bad or BadG occurring, plus the probability that the transcript 
is inconsistent. An additional term of the form (® c ) • 2~ 2n also appears because 
of an application of the triangle inequality. The complete details are omitted due 
to space constraints, though are available in the full version |GR04] . 

4 Conclusions 


We resolved a fundamental open problem of the Even-Mansour work by demon- 
strating that the underlying random permutation oracle could be instantiated 
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with a construction based on random function oracles. There are many avenues 
for future work. For example, we may be able to apply our techniques to other 
situations where random permutation oracles are useful. Also, there is a sizeable 
gap between the best known key-recovery attack and the bound achieved in our 
security proof. Perhaps that gap can be decreased by developing a variant on 
the slide-with-twist that exploits the structure of our construction. 
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Abstract. We consider the problem of defining and achieving plaintext- 
aware encryption without random oracles in the classical public-key 
model. We provide definitions for a hierarchy of notions of increasing 
strength: PAO, PA1 and PA2, chosen so that PA1+IND-CPA — > IND- 
CCA1 and PA2+IND-CPA -> IND-CCA2. Towards achieving the new 
notions of plaintext awareness, we show that a scheme due to Damgard 
[12], denoted DEG, and the “lite” version of the Cramer-Shoup scheme 
[TT| . denoted CS-lite, are both PAO under the DHKO assumption of [12] , 
and PA1 under an extension of this assumption called DHK1. As a result, 
DEG is the most efficient proven IND-CCA1 scheme known. 


1 Introduction 

The theory of encryption is concerned with defining and implementing notions 
of security for encryption schemes [22] 123] [13 123 123 IS]- One of the themes in its 
history is the emergence of notions of security of increasing strength that over 
time find applications and acceptance. 

Our work pursues, from the same perspective, a notion that is stronger than 
any previous ones, namely plaintext awareness. Our goal is to strengthen the 
foundations of this notion by lifting it out of the random-oracle model where 
it currently resides. Towards this end, we provide definitions of a hierarchy of 
notions of plaintext awareness, relate them to existing notions, and implement 
some of them. We consider this a first step in the area, however, since important 
questions are left unresolved. We begin below by reviewing existing work and 
providing some motivation for our work. 

1.1 Background 

Intuitively, an encryption scheme is plaintext aware (PA) if the “only” way that 
an adversary can produce a valid ciphertext is to apply the encryption algorithm 
to the public key and a message. In other words, any adversary against a PA 
scheme that produces a ciphertext “knows” the corresponding plaintext. 

Random-Oracle model work. The notion of PA encryption was first sug- 
gested by Bellare and Rogaway [6], with the motivation that PA+IND-CPA 
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should imply IND-CCA2. That is, security against chosen-plaintext attack 
coupled with plaintext awareness should imply security against adaptive chosen- 
ciphertext attack. The intuition, namely, that if an adversary knows the plaintext 
corresponding to a ciphertext it produces, then a decryption oracle must be use- 
less to it, goes back to [HE]. Bellare and Rogaway [6] provided a formalization 
of PA in the random oracle (RO) model. They asked that for every adversary A 
taking the public key and outputting a ciphertext, there exist an extractor that, 
given the same public key and a transcript of the interaction of A with its RO, 
is able to decrypt the ciphertext output by A. We will refer to this notion as 
PA-BR. 

Subsequently, it was found that PA-BR was too weak for PA-BR+IND-CPA 
to imply IND-CCA2. Bellare, Desai, Pointcheval and Rogaway [3] traced the 
cause of this to the fact that PA-BR did not capture the ability of the adversary 
to obtain ciphertexts via eavesdropping on communications made to the receiver. 
(Such eavesdropping can put into the adversary’s hands ciphertexts whose de- 
cryptions it does not know, lending it the ability to create other ciphertexts 
whose decryptions it does not know.) They provided an appropriately enhanced 
definition (still in the RO model) that we denote by PA-BDPR, and showed that 
PA-BDPR+IND-CPA -► IND-CCA2. 

Plaintext awareness is exploited, even though typically implicitly rather than 
explicitly, in the proofs of the IND-CCA2 security of numerous RO-model en- 
cryption schemes, e.g., PHEUE]. 

PA and the RO model. By restricting the above-mentioned RO-model defini- 
tions to schemes and adversaries that do not query the RO, one obtains natural 
counterpart standard (i.e., non-RO) model definitions of PA. These standard- 
model definitions turn out, however, not to be achievable without sacrificing 
privacy, because the extractor can simply be used for decryption. This indicates 
that the use of the RO model in the definitions of [HE] is central. 

Indeed, PA as per J6]|l] is “designed” for the RO model in the sense that 
the definition aims to capture certain properties of certain RO-model schemes, 
namely, the fact that possession of the transcript of the interaction of an adver- 
sary with its RO permits decryption of ciphertexts formed by this adversary. It 
is not clear what counterpart this intuition has in the standard model. 

The lack of a standard-model definition of PA results in several gaps. One 
such arises when we consider that RO-model PA schemes are eventually instan- 
tiated to get standard-model schemes. In that case, what property are these 
instantiated schemes even supposed to possess? There is no definition that we 
might even discuss as a target. 

PA via key registration. PA without ROs was first considered by Herzog, 
Liskov and Micali m, who define and implement it in an extension of the usual 
public-key setting. In their setting, the sender (not just the receiver) has a public 
key, and, in a key-registration phase that precedes encryption, proves knowledge 
of the corresponding secret key to a key-registration authority via an interactive 
proof of knowledge. Encryption is a function of the public keys of both the sender 
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and the receiver, and the PA extractor works by extracting the sender secret key 
using the knowledge extractor of the interactive proof of knowledge. 

Their work also points to an application of plaintext-aware encryption where 
the use of the latter is crucial in the sense that IND-CCA2-secure encryption 
does not suffice, namely to securely instantiate the ideal encryption functions of 
the Dolev-Yao model [14] . 


1.2 Our Goals and Motivation 

The goal of this work is to provide definitions and constructions for plaintext- 
aware public-key encryption in the standard and classical setting of public-key 
encryption, namely the one where the receiver (but not the sender) has a public 
key, and anyone (not just a registered sender) can encrypt a message for the 
receiver as a function of the receiver’s public key. In this setting there is no 
key-registration authority or key-registration protocol akin to Ell- 

Motivations include the following. As in the RO model, we would like a 
tool enabling the construction of public-key encryption schemes secure against 
chosen-ciphertext attack. We would also like to have some well-defined notion 
that can be viewed as a target for instantiated RO-model PA schemes. (One 
could then evaluate these schemes with regard to meeting the target.) 

Additionally, we would like to enable the possibility of instantiating the ideal 
encryption functions of the Dolev-Yao model [T5] without recourse to either 
random oracles or the key-registration model. Note that the last is an application 
where, as per [21], PA is required and IND-CCA2 does not suffice, meaning 
plaintext-awareness is crucial. (However, see also pQ.) 

As we will see later, consideration of PA in the standard model brings other 
benefits, such as some insight, or at least an alternative perspective, on the 
design of existing encryption schemes secure against chosen-ciphertext attack. 
Let us now discuss our contributions. 


1.3 Definitions 

The first contribution of this paper is to provide definitions for plaintext-aware 
encryption in the standard model and standard public-key setting. 

Overview. We provide a hierarchy consisting of three notions of increasing 
strength that we denote by PAO, PA1 and PA2. There are several motivations 
for this. One is that these will be seen (in conjunction with IND-CPA) to imply 
security against chosen-ciphertext attacks of different strengths. Another is that, 
as will become apparent, PA is difficult to achieve, and progress can be made by 
first achieving it in weaker forms. Finally, it is useful, pedagogically, to bring in 
new definitional elements incrementally. 

A CLOSER LOOK. Our basic definitional framework considers a polynomial-time 
adversary C, called a ciphertext creator, that takes input the public key and 
can query ciphertexts to an oracle. A polynomial-time algorithm C* is said to 
be a successful extractor for C if it can provide replies to the oracle queries of C 
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PAO+IND-CPA -* PA1+IND-CPA * PA2+IND-CPA 

m 

IND-CPA ind -CCA1 IND-CCA2 

Fig. 1. An arrow is an implication, and, in the directed graph given by the arrows, 
there is a path from A to B if and only if A implies B. The hatched arrows represent 
separations. Solid lines represent results from this paper, while dashed lines represent 
results from prior work [4lllo] . The number on an arrow or hatched arrow refers to the 
theorem in this paper that establishes this relationship. Absence of a number on a solid 
arrow means the result is trivial 

that are computationally indistinguishable from those provided by a decryption 
oracle. 

An important element of the above framework is that the extractor gets as 
input the same public key as the ciphertext creator, as well as the coin tosses 
of the ciphertext creator. This reflects the intuition that the extractor is the 
“subconscious” of the adversary, and begins with exactly the same information 
as the adversary itself. 

We say that an encryption scheme is PAO (respectively, PA1) if there exists 
a successful extractor for any ciphertext creator that makes only a single oracle 
query (respectively, a polynomial number of oracle queries). 

Eavesdropping capability in PA2 is captured by providing the ciphertext 
creator C with an additional oracle that returns ciphertexts, but care has to be 
taken in defining this oracle. It does not suffice to let it be an encryption oracle 
because we want to model the ability of the adversary to obtain ciphertexts whose 
decryptions it may not know. Our formalization of PA2 allows the additional 
oracle to compute a plaintext, as a function of the query made to it and coins 
unknown to C, and return the encryption of this plaintext to C. 

Formal definitions of PAO, PA1 and PA2 are in Section [3] 

1.4 Relations 

PA by itself is not a notion of privacy, and so we are typically interested in PA 
coupled with the minimal notion of privacy, namely IND-CPA J22H2H] • We con- 
sider six notions, namely, PAO+IND-CPA, PA1+IND-CPA and PA2+IND-CPA, 
on the one hand, and the standard notions of privacy IND-CPA, IND-CCA1 
[25] and IND-CCA2 [27], on the other. We provide implications and separa- 
tions among these six notions in the style of [4][15]. The results are depicted in 
Figured] For notions A, B, an implication, represented by A — > B, means that 
every encryption scheme satisfying notion A also satisfies notion B, and a separa- 
tion, represented by A /-> B, means that there exists an encryption scheme satis- 
fying notion A but not satisfying notion B. (The latter assumes there exists some 
encryption scheme satisfying notion A, since otherwise the question is vacuous.) 
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Figure Q] shows a minimal set of arrows and hatched arrows, but the relation 
between any two notions is resolved by the given relations. For example, IND- 
CCA1 /->PA1+IND-CPA, because, otherwise, there would be a path from IND- 
CCA2 to PAO+IND-CPA, contradicting the hatched arrow labeled [3] Similarly, 
we get PAO /->PA1 /->PA2, meaning the three notions of plaintext awareness 
are of increasing strength. 

The main implications are that PA1+IND-CPA implies IND-CCA1 and 
PA2+IND-CPA implies IND-CCA2. The PA1+IND-CPA -► IND-CCA1 result 
shows that even a notion of PA not taking eavesdropping adversaries into account 
is strong enough to imply security against a significant class of chosen-ciphertext 
attacks. Since the PA+IND-CPA — > IND-CCA2 implication has been a moti- 
vating target for definitions of PA, the PA2+IND-CPA — > IND-CCA2 result 
provides some validation for the definition of PA2. 

Among the separations, we note that IND-CCA2 does not imply PAO, mean- 
ing even the strongest form of security against chosen-ciphertext attack is not 
enough to guarantee the weakest form of plaintext awareness. 

1.5 Constructions 

The next problem we address is to find provably-secure plaintext-aware encryp- 
tion schemes. 

Approaches. A natural approach to consider is to include a non- interactive 
zero- knowledge proof of knowledge [T3] of the message in the ciphertext. How- 
ever, as we explain in [2] , this fails to achieve PA. 

As such approaches are considered and discarded, it becomes apparent that 
achieving even the weaker forms of PA in the standard (as opposed to RO) 
model may be difficult. We have been able to make progress, however, under 
some strong assumptions that we now describe. 

DHK assumptions. Let G be the order q subgroup of % 2 q+i , where q,2q+l 
are primes, and let g be a generator of G. Damgard [T2] introduced and used an 
assumption that states, roughly, that an adversary given g a and outputting a 
pair of the form ( g b ,g ab ) must “know” b. The latter is captured by requiring an 
extractor that given the adversary coins and inputs can output b. We call our 
formalization of this assumption (cf. Assumption [2| DHKO0 We also introduce 
an extension of this assumption called DHK1 (cf. Assumption [T]) , in which the 
adversary does not just output one pair {g b ,g ab ), but instead interacts with the 


1 Another formalization, called DA-1, is used by Hada and Tanaka [19]. (We refer 
to the full version of their paper [T9] , which points out that the formalization of 
the preliminary version [20] is wrong.) This differs from DHKO in being for a non- 
uniform setting. DA-1 is called KEA1 by [5], based on Naor’s terminology |24 |: KEA 
stands for “knowledge of exponent.” Hada and Tanaka [19] also introduced and used 
another assumption, that they call DA-2 and is called KEA2 in [5], but the latter 
show that this assumption is false. The DHK0/DA-1/KEA1 assumptions, to the best 
of our knowledge, are not known to be false. 
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extractor, feeding it such pairs adaptively and each time expecting back the 
discrete logarithm of the first component of the pair. 

The DEG scheme. Damgard presented a simple ElGamal variant that we call 
DEG. It is efficient, requiring only three exponentiations to encrypt and two to 
decrypt. 

We prove that DEG is PAO under the DHKO assumption and PA1 under 
the DHK1 assumption. Since DEG is easily seen to be IND-CPA under the 
DDH assumption, and we saw above that PA1+IND-CPA — > IND-CCA1, a 
consequence is that DEG is IND-CCA1 assuming DHK1 and DDH. DEG is in 
fact the most efficient IND-CCA1 scheme known to date to be provably secure 
in the standard model. 

Damgard m claims that DEG meets a notion of security under ciphertext 
attack that we call RPR-CCA1, assuming DHKO and assuming the ElGamal 
scheme meets a notion called RPR-CPA. (Both notions are recalled in the full 
version of this paper [2], and are weaker than IND-CCA1 and IND-CPA, re- 
spectively). As we explain in |2], his proof has a flaw, but his overall approach 
and intuition are valid, and the proof can be fixed by simply assuming DHK1 in 
place of DHKO. In summary, our contribution is (1) to show that DEG meets a 
stronger and more standard notion of security than RPR-CCA1, namely IND- 
CCA1, and (2) to show it is PAO and PA1, indicating that it has even stronger 
properties, and providing some formal support for the intuition given in [12] 
about the security underlying the scheme. 

CS-Lite. CS-lite is a simpler and more efficient version of the Cramer-Shoup 
encryption scheme m that is IND-CCA1 under the DDH assumption. We show 
that CS-lite is PAO under the DHKO assumption and PA1 under the DHK1 
assumption. (IND-CPA under DDH being easy to see, this again implies CS-lite is 
IND-CCA1 under DHK1 and DDH, but in this case the conclusion is not novel.) 
What we believe is interesting about our results is that they show that some form 
of plaintext awareness underlies the CS-lite scheme, and this provides perhaps 
an alternative viewpoint on the source of its security. We remark, however, that 
DEG is more efficient than CS-lite. 

Warning and discussion. DHKO and DHK1 are strong and non-standard 
assumptions. As pointed out by Naor [!M] , they are not efficiently falsifiable. 
(However, such assumptions can be shown to be false as exemplified in [5]). 
However standard-model schemes, even under strong assumptions, might provide 
better guarantees than RO model schemes, for we know that the latter may 
not provide real-world security guarantees at all [10l[26l[lHl[3] . Also, PA without 
random oracles is challenging to achieve, and we consider it important to “break 
ground” by showing it is possible, even if under strong assumptions. 

Open questions. The central open question is to find an IND-CPA+PA2 
scheme provably secure under some plausible assumption. We suggest, in partic- 
ular, that an interesting question is whether the Cramer-Shoup scheme, already 
known to be IND-CCA2, is PA2 under some appropriate assumption. (Intu- 
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itively, it seems to be PA2.) It would also be nice to achieve PAO or PA1 under 
weaker and more standard assumptions than those used here. 


2 Notation and Standard Definitions 

We let N = (1,2,3, . . .}. We denote by e the empty string, by \x\ the length of 
a string x, by x the bitwise complement of x, by “||” the string-concatenation 
operator, and by l fc the string of k £ N ones. We denote by [] the empty list. 
Given a list L and an element x, L@x denotes the list consisting of the elements 
in L followed by x. If S is a randomized algorithm, then S(x, y,. . ,;R) denotes 
its output on inputs x, y, . . . and coins R:. s S(x. y. . . .) denotes the result of 
picking R at random and setting s = S(x, y. . . .:R): and [S(x, y, . . .)] denotes 
the set of all points having positive probability of being output by S on inputs 
x, y, Unless otherwise indicated, an algorithm is randomized. 

Encryption schemes. We recall the standard syntax. An asymmetric (also 
called public-key) encryption scheme is a tuple AS = (fC. S. V. MsgSp) whose 
components are as follows. The polynomial-time key-generation algorithm 1C 
takes input l fc , where k £ N is the security parameter, and returns a pair (pi, si) 
consisting of a public key and matching secret key. The polynomial-time encryp- 
tion algorithm £ takes a public key pi and a message M to return a ciphertext 
C. The deterministic, polynomial-time decryption algorithm V takes a secret 
key si and a ciphertext C to return either a message M or the special sym- 
bol T indicating that the ciphertext is invalid. The polynomial-time computable 
message-space function MsgSp associates to each public key pi a set MsgSp(pi) 
called the message space of pi. It is required that for every k £ N 

Pr [ (pi, si) 4- K{l k ) ; M 4- MsgSp(pi) ; C 4- £(pk, M) : X>(si, C) = M ] - 1 . 

Standard security notions. We recall the definitions of IND-CPA, IND- 
CCA1, and IND-CCA2 security that originate in [35], [55] . and [57], respectively. 
We use the formalizations of [4]. Let AS = (/C, £, V, MsgSp) be an asymmetric 
encryption scheme, let k G N and b £ {0,1}. Let X be an algorithm with access 
to an oracle. For aaa £ (cpa, ccal,cca2}, consider the following experiment 

Experiment Exp^'^^’^/e) 

(pi, si) A/C(l fe ) ; (M 0 , Mi, St) X Ol 0) (find, pi) ; C^-£{pk,M b ) 

d <— X° 2 0) (guess, C, St) ; Return d 


where 

If aaa = cpa then O i(-) = e and 02(0 = £ 

If aaa = ccal then Oi(-) = T > sk ( 0 and 02(0 = £ 

If aaa = cca2 then 0i(-) = D sk {-) and 02(0 = X>sk( 0 

In each case it is required that Mo, Mi £ MsgSp(pi) and |Mo| = |Mi|. In the 

case of IND-CCA2, it is also required that X not query its decryption oracle with 
ciphertext C. We call X an ind-aaa-adversary. The ind-aaa-advantage of X is 
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Experiment Exp^ 1 "^ D (fc) 

(pic, sir) 4- /C(l fc ) ! x 4- C v< ~ sk ' \pk) ; d 4- D(x) ; Return d 
Experiment Exp^'p D c « (k) 

(pk,sk) 4- /C(l fc ) 

Choose coins fi[C],iZ[C*] for C, C*, respectively; St[C*] <— (pk,R[C\) 

Run C on input pk and coins -R[C] until it halts, replying to its oracle queries 
as follows: 

- If C makes query Q then 

(M, St[C*]) C*(Q, St[C*];iJ[C*]) ; Return M to C as the reply Endlf 

Let x denote the output of C ; d <— D(x) ; Return d 

Fig. 2. Experiments used to define PA1 and PAO 

Adv Sf,x aa (fc) = Pr [ Ex Pl4£,x aa 1 (^) = l] -Pr [ Ex P!4£,x a °(fe) = l] ■ 

For AAA e {CPA, CCA1, CCA2}, AS is said to be IND-AAA secure if 
Adv i 4 £~x aa (') i s negligible for every polynomial-time ind-aaa- adversary X. 

3 New Notions of Plaintext Awareness 

In this section we provide our formalizations of plaintext-aware encryption. We 
provide the formal definitions first and explanations later. We begin with PA1, 
then define PAO via this, and finally define PA2. 

Definition 1. [PA1] Let AS = (1C, £, T>. MsgSp) be an asymmetric encryption 
scheme. Let C be an algorithm that has access to an oracle, takes as input a 
public key pk, and returns a string. Let D be an algorithm that takes a string 
and returns a bit. Let C* be an algorithm that takes a string and some state 
information, and returns a message or the symbol _L, and a new state. We call C 
a ciphertext- creator adversary, D a distinguisher, and C* a pal-extractor. For 
k £ N, we define the experiments shown in Figure [H The pal-advantage of C 
relative to D and C* is 

Adv S£,C,D,C*(^) = Pr [ Ex Pyl£ ,C, d(^) = l] Pr [ Ex Pyl£,C,D,C*(^) = l] • 
We say that C* is a successful pal-extractor for C if for every polynomial- 
time distinguisher D the function Adv^ 1 c D c * (■) is negligible. We say AS is 
PA1 secure if for any polynomial-time ciphertext creator there exists a successful 
polynomial-time pal-extractor. | 

Definition 2. [PAO] Let AS be an asymmetric encryption scheme. We call a 
ciphertext-creator adversary that makes exactly one oracle query a paO ciphertext 
creator. We call a pal-extractor for a paO ciphertext creator a paO- extractor. We 
say that AS is PAO secure if for any polynomial-time paO ciphertext creator 
there exists a successful polynomial-time paO-extractor. I 
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Experiment Exp^?~ c p D (k) 

(pk, sk) 4 - K(l k ) ; Clist <— [] 

Choose coins R[C], R[P] for C, P, respectively ; St[P] <— e 

Run C on input pk and coins _R[C] until it halts, replying to its oracle queries 

as follows: 

- If C makes query (dec, Q) then 

M <— T>(sk, Q) ; Return M to C as the reply Endlf 

- If C makes query (enc, Q ) then 

(M, St[P]) «- P(Q, St[P]; R[P]) ; C 4 - £{pk, M ) ; Clist Clist @ C 
Return C to C as the reply Endlf 
Let x denote the output of C ; d <— D(x) ; Return d 


Experiment Exp^"^ P D c * (fc) 

(pk,sk) ^ /c( i fc ) ; Clist <— [] 

Choose coins P[C], R[P], R[C*] for C, P, C, respectively 
St[P] 4- e ; St[C*] 4- (pk,R[Cj) 

Run C on input pk and coins P[C] until it halts, replying to its oracle queries 
as follows: 

- If C makes query (dec, Q ) then 

(M, St[C*]) C*(Q, Clist, St[C*] ; P[C*]) 

Return M to C as the reply Endlf 

- If C makes query (enc, Q) then 

(M, St[P]) P(Q, St[P] ; R[P ]) ; C 4 - £{pk, M ) ; Clist Clist @ C 
Return C to C as the reply Endlf 
Let x denote the output of C ; d <— D(x) ; Return d 

Fig. 3. Experiments used to define PA2 

We now explain the ideas behind the above formalisms. The core of the 
formalization of plaintext awareness of asymmetric encryption scheme AS = 
(fC,S, X>,MsgSp) considers a polynomial-time ciphertext-creator adversary C 
that takes input a public key pk, has access to an oracle and returns a string. 
The adversary tries to distinguish between the cases that its oracle is V(sk, •), or 
it is an extractor algorithm C* that takes as input the same public key pk. PA1 
security requires that there exist a polynomial-time C* such that C’s outputs in 
the two cases are indistinguishable. We allow C* to be stateful, maintaining state 
St[C*] across invocations. Importantly, C* is provided with the coin tosses of C; 
otherwise, C* would be functionally equivalent to the decryption algorithm and 
thus could not exist unless AS were insecure with regard to providing privacy. We 
remark that this formulation is stronger than one not involving a distinguisher 
D , in which C simply outputs a bit representing its guess, since C* gets the 
coins of C, but not the coins of D. 

PAO security considers only adversaries that make a single query in their 
attempt to determine if the oracle is a decryption oracle or an extractor. 



Towards Plaintext- Aware Public-Key Encryption Without Random Oracles 


57 


Definition 3. [PA2] Let AS = (/C, £, T>, MsgSp) be an asymmetric encryption 
scheme. Let C be an algorithm that has access to an oracle, takes as input a 
public key pk, and returns a string. Let P be an algorithm that takes a string 
and some state information, and returns a message and a new state. Let D be 
an algorithm that takes a string and returns a bit. Let C* be an algorithm 
that takes a string, a list of strings and some state information, and returns 
a message or the symbol _L, and a new state. We call C a ciphertext- creator 
adversary, P a plaintext- creator adversary, D a distinguisher, and C* a pa2- 
extractor. For k £ N, we define the experiments shown in Figure |3] It is required 
that, in these experiments, C not make a query (dec, C) for which C £ Clist. 
The pa2-advantage of C relative to P, D and C* is 

Adv^ c , P D C ,(fc) = Pr [Exp5g£ PiD (fc> = l] - Pr [ Exp^c.P.n.c* (*) = l] ■ 

We say that C* is a successful pa2- extractor for C if for every polynomial- 
time plaintext creator P and distinguisher D, the function Adv^ c p d c*(') 
is negligible. We say AS is PA 2 secure if for any polynomial-time ciphertext 
creator there exists a successful polynomial-time pa2-extractor. | 

In the definition of PA2, the core setting of PA1 is enhanced to model the 
real-life capability of a ciphertext creator to obtain ciphertexts via eavesdropping 
on communications made by a third party to the receiver (cf. [4]). Providing C 
with an encryption oracle does not capture this because eavesdropping puts into 
C’s hands ciphertexts of which it does not know the corresponding plaintext, 
and, although we disallow C to query these to its oracle, it might be able to 
use them to create other ciphertexts whose corresponding plaintext it does not 
know and on which the extractor fails. 

Modeling eavesdropping requires balancing two elements: providing C with a 
capability to obtain ciphertexts of plaintexts it does not know, yet capturing the 
fact that C might have partial information about the plaintexts, or control of 
the distribution from which these plaintexts are drawn. We introduce a compan- 
ion plaintext- creator adversary P who, upon receiving a communication from 
C, creates a plaintext and forwards it to an encryption oracle. The ciphertext 
emanating from the encryption oracle is sent to both C and C*. C has some 
control over P via its communication to P, but we ensure this is not total by 
denying C and C* the coin tosses of P, and also by asking that C* depend on 
C but not on P. 

The extractor C* is, as before, provided with the coin tosses of C. Two types 
of oracle queries are allowed to C. Via a query (dec, Q), it can ask its oracle to 
decrypt ciphertext Q. Alternatively, it can make a query (enc, Q) to call P with 
argument Q, upon which the latter computes a message M and forwards it to 
the encryption oracle, which returns the resulting ciphertext to C, and C* in the 
case that C’s oracle is C*. We observe that if an asymmetric encryption scheme 
is PA2 secure then it is PA1 secure, and if it is PA1 secure then it is PAO secure. 

See [2] for extensive comparisons of these definitions with previous ones, and 
also for stronger, statistical versions of these notions. 
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4 Relations Among Notions 

We now state the formal results corresponding to Figure [TJ beginning with the 
two motivating applications of our notions of plaintext awareness. Proofs of these 
results are provided in the full version of this paper [2] . 

Theorem 1. [PA1+IND-CPA => IND-CCA1] Let A£ be an asymmetric 
encryption scheme. If AE is PA1 secure and IND-CPA secure, then it is IND- 
CCA1 secure. I 

Theorem 2. [PA2+IND-CPA => IND-CCA2] Let A£ be an asymmetric 
encryption scheme. If A£ is PA2 secure and IND-CPA secure, then it is IND- 
CCA2 secure. I 

Theorem 3. [IND-CCA2 /^PAO+IND-CPA] Assume there exists an IND- 
CCA2-secure asymmetric encryption scheme. Then there exists an IND-CCA2- 
secure asymmetric encryption scheme that is not PAO secure. | 

Theorem 4. [PA1+IND-CPA /=>IND-CCA2] Assume there exists a PA1 
secure and IND-CPA-secure asymmetric encryption scheme. Then there exists 
a PA1 secure and IND-CPA-secure asymmetric encryption scheme that is not 
IND-CCA2 secure. | 

Theorem 5. [PAO+IND-CPA /^IND-CCAl] Assume there exists a PAO 
secure and IND-CPA-secure asymmetric encryption scheme. Then there exists 
a PAO secure and IND-CPA-secure asymmetric encryption scheme that is not 
IND-CCA1 secure. \ 


5 Constructions 

Prime-order groups. If p, q are primes such that p = 2q + 1, then we let 
G q denote the subgroup of quadratic residues of Z*. Recall this is a cyclic sub- 
group of order q. If g is a generator of G q then d\og g f/ (X) denotes the discrete 
logarithm of X G G q to base g. A prime- order- group generator is a polynomial- 
time algorithm G that on input l fe returns a triple ( p,q,g ) such that p,q are 
primes with p = 2q + 1, g is a generator of G q , and 2 k ~ 1 < p < 2 k (p is k bits 
long). 

The DHK assumptions. Let G be a prime-order-group generator, and suppose 
(p, q, g) G [G(l fe )]. We say that (A,B,W) is a DH-triple if there exist a,b G Z q 
such that A = g a mod p, B = g b mod p and W = g ab mod p. We say that ( B , W) 
is a DH-pair relative to A if (A, B. W) is a DH-triple. One way for an adversary 
H taking input p, q, g, A to output a DH-pair (B, W) relative to A is to pick 
— and thus “know” — some b G Z g , set B = g b mod p and W = A h mod p, and 
output (B,W). Damgard [T2] makes an assumption which, informally, says that 
this is the “only” way that a polynomial-time adversary H can output a DH-pair 
relative to A. His framework to capture this requires that there exist a suitable 
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Experiment Exp'g 1 ^ 1 H . (k) 

(p,q,g) G{ l k ) ; a 4- Z g ; A <- g a modp 

Choose coins R[H],R[H*] for H, H* , respectively; St[JT] <- ((p, q, g, A). R[H]) 
Run H on input p, q, g, A and coins R[H] until it halts, replying to its oracle 
queries as follows: 

- If H makes query ( B , W) then 

(6, St [H*]) <- H*{{B, W), St[H*]; R[H*]) 

If W = B a (mod p) and B j^g b (mod p) then return 1 
Else return 6 to H as the reply Endlf Endlf 
Return 0 

Fig. 4. Experiment used to define the DHK1 and DHKO assumptions 


extractor H* that can compute dlog ? g (B) whenever H outputs some DH-pair 
(B, W) relative to A. 

We provide a formalization of this assumption that we refer to as the DHKO 
(DHK stands for Diffie-Hellman Knowledge) assumption. We also present a nat- 
ural extension of this assumption that we refer to as DHK1. Here the adversary 
JT, given p. q, g, A, interacts with the extractor, querying it adaptively. The ex- 
tractor is required to be able to return dlog g g (H) for each DH-pair (B,W) 
relative to A that is queried to it. Below we first present the DHK1 assumption, 
and then define the DHKO assumption via this. 

Assumption 1. [DHK1] Let G be a prime-order-group generator. Let JT be an 
algorithm that has access to an oracle, takes two primes and two group elements, 
and returns nothing. Let JT* be an algorithm that takes a pair of group elements 
and some state information, and returns an exponent and a new state. We call H 
a dhkl -ari'cersart/ and JT* a dlikl -extractor. For k £ N we define the experiment 
shown in Figure |U The dhkl -advantage of H relative to H* is 

Advg h ^,H* (k) = Pr [ (k) = 1 j . 

We say that G satisfies the DHK1 assumption if for every polynomial-time 
dhkl-adversary H there exists a polynomial-time dhkl-extractor JT* such that 
Adv G 4 T,H* (■) is negligible. I 

Assumption 2. [DHKO] Let G be a prime-order-group generator. We call a 
dhkl-adversary that makes exactly one oracle query a dhkO- adversary. We call 
a dhkl-extractor for a dhkO-adversary a dhkO -extractor. We say that G satisfies 
the Diffie-Hellman Knowledge (DHKO) assumption if for every polynomial-time 
dhkO-adversary JT there exists a polynomial-time dhkO-extractor H* such that 
Advg is negligible. I 

We observe that DHK1 implies DHKO in the sense that if a prime-order- 
group generator satisfies the former assumption then it also satisfies the latter 
assumption. 
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Algorithm K.(l k ) 

(p,q,g)^-G( l fc ) 

an <— Zq ; X\ <— g Xl mod p 

X 2 <— ; X 2 <— g X2 mod p 

Return ((p,q,g,X 1 ,X 2 ), (p,q,g,x i,x 2 )) 

Algorithm £ ((p, q, g, Xi,X 2 ), M ) 
y <— ; Y <— g y mod p 

W <— X y mod p ; V <— mod p 

U <—V ■ M mod p 

Return (Y. W, U) 

Algorithm q, g, xi,x 2 ), ( Y , W, U )) 

MsgSp ((p,q,g,X 1 ,X 2 )) = G q 

If W £eY Xi (mod p) then return T 


Else M *— U ■ Y~ X2 mod p ; Return M 


Endlf 



Fig. 5. Algorithms of the encryption scheme DEG = ( 7C , £, V, MsgSp) based on prime- 
order-group generator G 


Constructions. We would like to build an asymmetric encryption scheme that 
is PAO secure (and IND-CPA secure) under the DHKO assumption. An obvious 
idea is to use ElGamal encryption. Here the public key is X = g x , where x is the 
secret key, and an encryption of message M G G q has the form ( Y,U ), where 
Y = g y mod p and U = X y ■ M mod p = g xy ■ M mod p. However, we do not 
know whether this scheme is PAO secure. 

We consider a modification of the ElGamal scheme that was proposed by 
Damgard m- We call this scheme Damgard, ElGamal or DEG. It is parameter- 
ized by a prime-order group generator G, and its components are depicted in 
Figure El The proof of the following is in the full version of this paper [2]: 

Theorem 6. Let G be a prime-order-group generator and let DEG = (1C. £. 
D, MsgSp) be the associated Damgard ElGamal asymmetric encryption scheme 
defined in Figure El If G satisfies the DHKO and DDH assumptions then DEG 
is PAO+IND-CPA secure. If G satisfies the DHK1 and DDH assumptions then 
DEG is PA1+IND-CPA secure. | 

As a consequence of the above and Theorem [lj DEG is IND-CCA1 secure 
under the DHK1 and DDH assumptions. DEG is in fact the most efficient known 
IND-CCA1 scheme with some proof of security in the standard model. 

Next we consider the “lite” version of the Cramer-Shoup asymmetric encryp- 
tion scheme [IT] . The scheme, denoted CS-lite, is parameterized by a prime-order 
group generator G, and its components are depicted in Figure |6] This scheme is 
known to be IND-CCA1 secure under the DDH assumption mi- We are able to 
show the following. The proof can be found in [2] . 

Theorem 7. Let G be a prime- order- group generator, and let CS-lite = (1C, £. 
V, MsgSp) be the associated Cramer-Shoup lite asymmetric encryption scheme 
defined in Figure [H If G satisfies the DHKO and DDH assumptions then CS-lite 
is PAO+IND-CPA secure. If G satisfies the DHK1 and DDH assumptions then 
CS-lite is PA1+IND-CPA secure. I 
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Algorithm /C(l fc ) 

( V , q,9i)^- G( l fc ) ; g 2 ^-G q \ {1} 

X\ ILq ; X2 - Z q ; Z 'Etq 

X <— gi 1 • g% 2 mod p ; Z <— g\ mod p 

Return ((p, q, g x ,g 2 ,X, Z), (p , q, gi,g 2 , Xi,x 2 , z)) 

Algorithm £((p,q,g±,g 2 ,X, Z),M) 
r^-Z q 

Ri <— g{ mod p 

R 2 t— g 2 mod p 

E <— Z r ■ M mod p 

V <— X r mod p 

Return (R!,R 2 ,E,V) 

Algorithm V((p, q, gi, g 2 ,xi,x 2 , z), (Ri,R 2 , E, V)) 
If V /GRj 1 ■ i?2 2 (mod p) then return T 

Else M <— E ■ R^ z mod p ; Return M Endlf 

MsgS V ((p,q, gi ,g 2 ,X,Z)) = G q 


Fig. 6. Algorithms of the encryption scheme CS-lite = (1C, S, V, MsgSp) based on 
prime-order-group generator G 


Again, the above and Theorem Q] imply that CS-lite is IND-CCA1 secure 
under the DHK1 and DDH assumptions. This however is not news, since we 
already know that DDH alone suffices to prove it IND-CCA1 m- However, 
it does perhaps provide a new perspective on why the scheme is IND-CCA1, 
namely that this is due to its possessing some form of plaintext awareness. 

In summary, we have been able to show that plaintext awareness without 
ROs is efficiently achievable, even though under very strong and non-standard 
assumptions. 
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Abstract. The OAEP construction is already 10 years old and well- 
established in many practical applications. But after some doubts about 
its actual security level, four years ago, the first efficient and provably 
IND-CCA1 secure encryption padding was formally and fully proven to 
achieve the expected IND-CCA2 security level, when used with any trap- 
door permutation. Even if it requires the partial-domain one-wayness 
of the permutation, for the main application (with the RSA permuta- 
tion family) this intractability assumption is equivalent to the classical 
(full-domain) one-wayness, but at the cost of an extra quadratic-time 
reduction. The security proof which was already not very tight to the 
RSA problem is thus much worse. 

However, the practical optimality of the OAEP construction is two- 
fold, hence its attractivity: from the efficiency point of view because of 
two extra hashings only, and from the length point of view since the 
ciphertext has a minimal bit-length (the encoding of an image by the 
permutation.) But the bandwidth (or the ratio ciphertext /plaintext) is 
not optimal because of the randomness (required by the semantic secu- 
rity) and the redundancy (required by the plaintext-awareness, the sole 
way known to provide efficient CCA2 schemes.) 

At last Asiacrypt ’03, the latter intuition had been broken by exhibit- 
ing the first IND-CCA2 secure encryption schemes without redundancy, 
and namely without achieving plaintext-awareness, while in the random- 
oracle model: the OAEP 3-round construction. But this result achieved 
only similar practical properties as the original OAEP construction: the 
security relies on the partial-domain one-wayness, and needs a trapdoor 
permutation, which limits the application to RSA, with still a quite bad 
reduction. 

This paper improves this result: first we show the OAEP 3-round ac- 
tually relies on the (full-domain) one-wayness of the permutation (which 
improves the reduction) , then we extend the application to a larger class 
of encryption primitives (including ElGamal, Paillier, etc.) The extended 
security result is still in the random-oracle model, and in a relaxed CCA2 
model (which lies between the original one and the replayable CCA sce- 
nario.) 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
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1 Introduction 

The OAEP construction |4][l2],|l3] is now well-known and widely used, since 
it is an efficient and secure padding. However, the latter property had been 
recently called into question: indeed, contrarily to the widely admitted result, 
the security cannot be based on the sole one-wayness of the permutation [E8l . 
but the partial-domain one-wayness [ 12. 13| . For an application to RSA, the 
main trapdoor one-way permutation, the two problems are equivalent, but the 
security reduction is much worse than believed, because of a quadratic reduction 
between the two above problems. 

There is also a second drawback of the OAEP construction, since its use is 
limited to permutations. It can definitely not apply to any function, as tried and 
failed on the NTRU primitive |T5j . 

Finally, the optimality, as claimed in the name of the construction, is ambigu- 
ous and not clear: from the efficiency point of view, the extra cost for encryption 
and decryption is just two more hashings which is indeed quite good. But the 
most important optimality was certainly from the length point of view: the ci- 
phertext is just an image by the permutation, and thus the shortest as possible. 
However, another important parameter is the bandwidth, or the ratio cipher- 
text/plaintext, which is not optimal: the construction requires a randomness 
over 2k bits for a semantic security in 2~ k , and redundancy over k bits for pre- 
venting chosen-ciphertext attacks (plaintext-awareness): the ciphertext is thus 
at least 3 k bits as large as the plaintext. 

1.1 Related Work 

Right after the Shoup’s remark about the security of OAEP several alter- 
natives to OAEP have been proposed: OAEP+ (by Shoup himself) and SAEP, 
SAEP+ (by Boneh |6]) but either the bandwidth, or the reduction cost remain 
pretty bad. Furthermore, their use was still limited to permutations. 

About generic paddings applicable to more general encryption primitives, 
one had to wait five years after the OAEP proposal to see the first efficient 
suggestions: Fujisaki-Okamoto ||10, 11| proposed the first constructions, then 
Pointcheval [23] suggested one, and eventually Okamoto-Pointcheval in- 
troduced the most efficient construction, called REACT. However, all these 
proposals are far to be optimal for the ciphertext size. They indeed apply, 
in the random-oracle model, the general approach of symmetric and asym- 
metric components integration M- an ephemeral key is first encrypted using 
key-encapsulation, then this key is used on the plaintext with a symmetric en- 
cryption scheme (which is either already secure against chosen-ciphertext at- 
tacks, or made so by appending a MAC - or a tag with a random oracle, for 
achieving plaintext-awareness.) 

Plaintext-awareness |4, 3| was indeed the essential ingredient to achieve IND- 
CCA2 security in the random-oracle model: it makes the simulation of the de- 
cryption oracle quite easy, by rejecting almost all the decryption queries, unless 
the plaintext is clearly known. But this property reduces the bandwidth since 
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“unnecessary” redundancy is introduced. Randomness is required for the seman- 
tic security, but this is the sole mandatory extra data for constructing a secure 
ciphertext. At last Asiacrypt [2l] , the first encryption schemes with just such a 
randomness, but no redundancy, has been proposed: plaintext-awareness is no 
longer achieved, since any ciphertext is valid and corresponds to a plaintext. But 
this does not exclude the IND-CCA2 security level. In that paper [ 51 ], we indeed 
proved that an extension of OAEP, with 3 rounds but without redundancy, pro- 
vides an IND-CCA2 secure encryption scheme, with any trapdoor permutation, 
but again under the partial-domain one-wayness. Hence a bad security reduction. 

Note 1. The classical OAEP construction can be seen as a 2-round Feistel 
network, while our proposal [2l|] was a 3-round network, hence the name OAEP 
3-round. By the way, one should notice that SAEP [6] can be seen as a 1-round 
Feistel network. 


1.2 Achievements 

In this paper, we address the two above problems: the bad security reduction of 
the OAEP constructions, because of the need of the intractability of the partial- 
domain one-wayness; and the restriction to permutations. 

First, we show that, contrarily to the OAEP (2-round) construction which 
cannot rely on the (full-domain) one-wayness, the OAEP 3-round simply requires 
the (full-domain) one-wayness: because of the third round, the adversary looses 
any control on the r value. It is not able to make ciphertexts with the same r, 
without querying it. 

Then, we extend the application of OAEP 3-round to a larger class of encryp- 
tion primitives: it applies to any efficiently computable probabilistic injection 
/ : E X R — > F, which maps any x £ E into F in a probabilistic way according 
to the random string pgR. We need this function to be one-way: given y g F, 
it must be hard to recover x g E (we do not mind about the random string 
p)\ this probabilistic function also needs to satisfy uniformity properties which 
are implied by a simple requirement: / is a bijection from E x R onto F. Some 
additional restrictions will appear in the security proof: 

— we cannot really consider the CCA2 scenario, but a relaxed one denoted 
RCCA, which is between the usual one and the replayable CCA2 introduced 
last year [7] and considered enough in many applications. 

— the simulation will need a decisional oracle which checks whether two ele- 
ments in F have the same pre-images in E. The security result will thus be 
related to the well-known gap-problems [[19, 18| . 

This extension allows almost optimal bandwidths for many very efficient 
asymmetric encryption schemes, with an IND-RCCA security level related to gap- 
problems (e.g. an ElGamal variant related to the Gap Diffi e-Hellman problem.) 
Note that the application to trapdoor one-way permutations like RSA results 
in a much more efficient security result, and provides an IND-CCA2 encryption 
scheme under the sole one-wayness intractability assumption. 
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This paper is then organized as follows: in the next section, we review the 
classical security model for asymmetric encryption, and present our new CCA- 
variant. In sectionf3l we present the OAEP 3-round construction for any prob- 
abilistic injection, with some concrete applications. The security result is pre- 
sented and proven in section[4] 

2 Security Model 

In this section, we review the security model widely admitted for asymmetric 
encryption. Then, we consider some relaxed CCA-variants. First, let us briefly 
remind that a public-key encryption scheme S is defined by three algorithms: 
the key generation algorithm JC(l k ), which produces a pair of matching public 
and private keys (pk,sk); the encryption algorithm £ p k (m; r) which outputs a 
ciphertext c corresponding to the plaintext m £ M., using random coins r G 1Z: 
and the decryption algorithm T> s k(c) which outputs the plaintext m associated 
to the ciphertext c. 

2.1 Classical Security Notions 

Beyond one-wayness, which is the basic security level for an encryption scheme, 
it is now well-admitted to require semantic security ( a.k.a . polynomial security 
or indistinguishability of encryptions HU. denoted IND): if the attacker has some 
a priori information about the plaintext, it should not learn more with the view 
of the ciphertext. More formally, this security notion requires the computational 
indistinguishability between two messages, chosen by the adversary, one of which 
has been encrypted, which one has been actually encrypted with a probability 
significantly better than one half: the advantage Adv£ (A), where the adversary 
A is seen as a 2-stage Turing machine (Ai , A 2 ), should be negligible, where 
Adv|£ (A) is formally defined as 

2xPrf^ k ’ Sk )^ X '( lfc )’( m C” mi ’ S )^ 4l ( pk )’ 1 -1 
1 {0,1}, c = £ p k(m b ) : A 2 (to 0 , mi, s,c) = &J 

Stronger security notions have also been defined thereafter (namely the non- 
malleability [8]), but we won’t deal with it since it is similar to the semantic 
security in several scenarios [Hi- 

On the other hand, an attacker can use many kinds of attacks, according 
to the available information: since we are considering asymmetric encryption, 
the adversary can encrypt any plaintext of its choice with the public key, hence 
the basic chosen-plaintext attack. But the strongest attack is definitely when 
the adversary has an unlimited access to the decryption oracle itself, adaptive 
chosen- ciphertext attacks mi , denoted CCA or CCA2 (by opposition to the earlier 
lunchtime attacks [l3, denoted CCA1, where this oracle access is limited until 
the challenge is known.) From now, we simply use CCA instead of CCA2 since 
we focus on adaptive adversaries. 
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The strongest security notion that we now widely consider is the semantic 
security against adaptive chosen-ciphertext attacks denoted IND-CCA — where 
the adversary just wants to distinguish which plaintext, between two messages 
of its choice, had been encrypted; it can ask any query to a decryption oracle 
(except the challenge ciphertext). 

2.2 Relaxed CCA-Security 

First, at Eurocrypt ’02, An et al [I] proposed a “generalized CCA” security notion, 
where the adversary is restricted not to ask, to the decryption oracle, ciphertexts 
which are in relation with the challenge ciphertext. This relation must be an equiv- 
alence relation, publicly and efficiently computable, and decryption-respecting: if 
two ciphertexts are in relation, they necessarily encrypt identical plaintexts. This 
relaxation was needed in that paper, so that extra bits in the ciphertext, which can 
be easily added or suppressed, should not make the scheme theoretical insecure, 
while its security is clearly the same from a practical point of view. 

More recently, another relaxation (an extra one beyond the above one) has 
been proposed by Canetti et al [7]: informally, it extends the above relation 
to the (possibly non-computable) equality of plaintexts. More precisely, if the 
adversary asks for a ciphertext c to the decryption oracle, c is first decrypted 
into to. Then, if m is one of the two plaintexts output in the first stage by the 
adversary, the decryption oracle returns test, otherwise the actual plaintext to is 
returned. They called this variant the “replayable CCA” security. They explain 
that this security level, while clearly weaker than the usual CCA one, is enough 
in most of the practical applications. The classical CCA security level is indeed 
very strong, too strong for the same reasons as explained above for the first 
relaxation. 

In this paper, we could work with the latter relaxation, the “replayable CCA” 
scenario. But for a simpler security proof, as well as a more precise security result 
(with nice corollaries for particular cases, such as the RSA one) we restrict it 
a little bit into the “relaxed CCA” scenario, denoted RCCA. A scheme which 
is secure in this scenario is trivially secure in the “replayable CCA” one, but 
not necessarily in the “generalized CCA” or the usual CCA scenario. The actual 
relations between these scenarios depend on the way the random string is split. In 
the formal notation of the encryption algorithm, we indeed split the randomness 
in two parts r and p: c= E p \ <(m; r, p). The encryption algorithm is thus a function 
from M. x 1Z x R into the ciphertext set. We know that for being an encryption 
scheme, this function must be an injection with respect to M. (several elements in 
M. x 1Z x R can map to the same ciphertext, but all these elements must project 
uniquely on M.\ the plaintext.) In our new relaxation, we split the randomness 
in K x R so that this function is also an injection with respect to M. X 1Z. 

Let us assume that the challenge ciphertext is c* = £ p w(m *; r*, p*). Let us con- 
sider the ciphertext c = £ p k(m; r, p). According to the above comment, (to*, r*) 
and (to, r) are uniquely defined from c* and c respectively, while p* and p may not 
be unique. Upon receiving c, the relaxed decryption oracle first checks whether 
(m*,r*) = (to, r) in which case it outputs test. Otherwise, it outputs to. 
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Definition 2 (Relaxed CCA). In the “relaxed CCA” scenario, an adversary 
has an unlimited access to the relaxed decryption oracle. 

Property 3. Security in the “relaxed CCA” scenario implies security in the “re- 
playable CCA” one. 

Proof. As already noticed, this is a trivial relation, since the decryption oracle in 
the latter scenario can be easily simulated by the relaxed decryption oracle: if its 
output is test, this value is forwarded, else the returned plaintext m is compared 
to the output of the adversary at the end of the first stage. According to the 
result of the comparison, either a test-answer is also given (if m e {mo, mi}), 

This property was just to make clear that we do not relax more the CCA 
security, but still keep it beyond what is clearly acceptable for practical use. 
Namely, note that if R is the empty set, then the RCCA scenario is exactly the 
usual CCA one: if / is a permutation from E onto F (the RSA case.) 


3 OAEP 3-Round: A General and Efficient Padding 

3.1 The Basic Primitive 

Our goal is to prove that OAEP 3-round can be used with a large class of 
one-way functions. More precisely, we need an injective probabilistic trapdoor 
one-way function family (<£ p k)pk from a set E p k to a set F p k, respectively to the 
index pk: almost any encryption primitive, where the plaintext set is denoted 
E pk and the ciphertext set is denoted F pk , is fine: for any parameter pk (the 
public key), there exists the inverse function ip s k (where sk is the private key) 
which returns the pre-image in E p k- An injective probabilistic trapdoor one-way 
function / from E to F is actually a function / : E x R — *■ F, which takes 
as input a pair (x,p) and outputs y £ F. The element x lies in E and is the 
important input, p is the random string in R which makes the function to be 
probabilistic. Injectivity means that for any y there is at most one x (but maybe 
several p) such that y = f(x,p). The function g which on input y outputs x is 
the inverse of the probabilistic function /. Clearly, we need the function / to be 
efficiently computable, but the one-wayness means that computing the unique x 
(if it exists) such that y = f(x. p) is intractable (unless one knows the trapdoor 
g.) These are the basic requirement for an asymmetric encryption primitive. But 
for our construction to work, we need two additional properties: 

- the function / :ExR— »Fisa bijection; 

— without knowing the trapdoor, it is intractable to invert / in E, even for 
an adversary which has access to the decisional oracle Same/(y, y') which 
answers whether g{y) = g{y'). 

The latter property is exactly the “gap problem” notion, which is defined 
by the following success probability Succ® ap (t, q), for any adversary A whose 



OAEP 3-Round: A Generic and Secure Asymmetric Encryption Padding 


69 


running time is limited by t, and the number of queries to the decisional oracle 
Same/ is upper-bounded by q: 

Succf ap (t, q ) = max-fa; E, p •£- R, y = f(x, p ) : A Same/ ( y ) = a;}. 

J A 

For a family of functions, this success probability includes the random choice 
of the keys in the probability space, and assumes the inputs randomly drawn 
from the appropriate sets, hence the notation Succ® ap (t, q) for a family (</> p k) p k- 

3.2 Examples 

Let us see whether the two above additional properties are restrictive or not in 
practice: 

— The first example is clearly the RSA permutation [26], where for a given 
public key pk = (n, e), the sets are E = F = Z* and R is the empty set. Then, 
this is clearly an injective (but deterministic) function, which is furthermore 
a bijection. Because of the determinism, the decisional oracle Same(y,y') 
simply checks whether y = y': the gap problem is thus the classical RSA 
problem. 

— The goal of our extension of OAEP is to apply it to the famous ElGamal 
encryption [5] in a cyclic group G of order q, generated by g. Given a public 
key pk = y G G, the sets are E = G, R = Z g and F = G x G: ip y (x,p) = 
(g p , x x y p ), which is a probabilistic injection from E onto F, and a bijection 
from E x R onto F. About the decisional oracle, it should check, on inputs 
(a = g p ,b = x X y p ) and ( a ' = g p . b' = x' X y p ), whether x = x', which 
is equivalent to decide whether ( g,y,a'/a = g p ~ p ,b’/b = (x'/x) x y p ~ p ) 
is a Diffie-Hellman quadruple: the gap problem is thus the well-known Gap 
Diffie-Hellman problem [118. 19J . 

— One can easily see that the Paillier’s encryption [20] also fits this formalism. 

3.3 Description of OAEP 3-Round 

Notations and Common Parameters. For a simpler presentation, and an 
easy to read analysis, we focus on the case where E = {0, 1}” (is a binary set). 
A similar analysis as in [2^] could be performed to deal with more general sets. 
On the other hand, any function can be mapped into this formalism at some low 
cost [2]. 

The encryption and decryption algorithms use three hash functions: J 7 , Q , 
H (assumed to behave like random oracles in the security analysis) where the 
security parameters satisfy n = k + t: 

T : {0, l} fc — > {0, 1}^ Q : {0,1}* -► {0, l} fe H : {0, l} fc — > {0, 1}*. 

The encryption scheme uses any probabilistic injection family (</? p k)pk, whose 
inverses are respectively denoted fy s k , where sk is the private key associated to 
the public key pk. The symbol “||” denotes the bit-string concatenation and 
identifies {0, l} k x {0, l} e to {0, 1}”. 
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Encryption Algorithm. The space of the plaintexts is M = {0, 1}^, the en- 
cryption algorithm uses random coins, from two distinct sets r £ 1Z = {0, l} fc 
and p £ R, and outputs a ciphertext c into F: on a plaintext rri £ A4, one 
computes 


s = m®T{r) t = r®Q{s) u = s®H(t) c= <p pk (t\\u, p). 

Decryption Algorithm. On a ciphertext c, one first computes t||w = ip s k(c), 
where t £ {0, l} k and u £ {0, 1}^, and then 

s = u®H{t) r = t® Q{s) m = s®F(r). 

4 Security Result 

In this section, we state and prove the security of this construction. A sketch 
is provided in the body of the paper, the full proof can be found in the full 
version Ill- 

Theorem 4. Let A be an IND-RCCA adversary against the OAEP 3-round con- 
struction with any trapdoor one-way probabilistic function family (<^ p k) p k, within 
time t. Let us assume that after qp, q g , qu and q d queries to the random oracles 
T , Q and TL, and the decryption oracle respectively, its advantage Adv^”^ 3 (r) 
is greater than e. Then, Succ® ap (T / , qd{q g qh + Qd)) is upper-bounded by 



with t' <T + (q f + q g + q h + q d )Ti u + qjT Same + {qd + 1 )q g q h {T v + T Same ), where 
T v is the time complexity for evaluating any function (p p k, Ts ame is the time for 
the decisional oracle Same^ to give its answer, and T iu is the time complexity 
for a look up in a list. 

4.1 Trapdoor Permutations 

Before proving this general result, let us consider the particular case where p p y is 
a permutation from E onto F (i.e., a deterministic function.) The general result 
has indeed several drawbacks: 

— the reduction cost introduces a cubic factor q d q g qh which implies larger keys 
for achieving a similar security level as for some other constructions; 

— the security relies on a gap problem, which is a strong assumption in many 
cases; 

— and we cannot achieve the usual IND-CCA security level. 

These drawbacks are acceptable as the price of generality: this becomes one 
of the best padding for ElGamal or Paillier strongly secure variants. However, 
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for trapdoor permutations, such as RSA, several OAEP variants achieve much 
better efficiency. 

But one should interpret the above result in this particular case: first, the 
gap-problem becomes the classical one-wayness, since the decisional oracle is 
simply the equality test; Furthermore, the RCCA scenario becomes the classical 
CCA one; Finally, because of the determinism of the permutation, with proper 
bookkeeping, one can avoid the cubic factor, and fall back to the usual quadratic 
factor q g qh, as for any OAEP-like constructions (OAEP+, SAEP and SAEP+). 
Then, one can claim a much better security result: 

Theorem 5. Let A be an IND-CCA adversary against the OAEP 3-round con- 
struction with a trapdoor one-way permutation family (<^ p k) p k> within time t. Let 
us assume that after qf, q g , q h and q,i queries to the random oracles T , Q and 
Li, and the decryption oracle respectively, its advantage AdvJ, n ae p J5f(r) is greater 
than e. Then, Succor') is upper-bounded by 



with t' < t + (qf + q g + qh + q<i)Ti u + q g qhT v , where T v is the time complexity 
for evaluating any function g> p k and Ti u is the time complexity for a look up in 
a list. 

4.2 Sketch of the Proof 

The proof is very similar to the one in [21], but the larger class (injective proba- 
bilistic functions), and the improved security result (relative to the one-wayness) 
make some points more intricate: for a permutation /, each value x maps to a 
unique image y = f(x); whereas for a function /, each value x maps to several 
images y = f(x,p), according to the random string p. Consequently, when used 
as an asymmetric encryption primitive, the adversary may have the ability to 
build another y' whose pre-image is identical to the one of y: x = g(y) = g(y'). 
Such a query to the decryption oracle is not excluded in the CCA scenario, while 
we may not be able to either detect or answer. Hence the relaxed version of 
chosen-ciphertext security, and the decisional oracle Same/: the latter helps to 
detect ciphertexts with identical pre-images, the relaxed scenario gives the abil- 
ity to answer test in this case. Granted the decisional oracle Same/, we can also 
detect whether a decryption query c has the same pre-image as a previous de- 
cryption query d in which case we output the same plaintext. If it is a really new 
ciphertext, by using again the decisional oracle Same/, we can check whether s 
and t have both been asked to Q and 'LL, respectively, which immediately leads 
to the plaintext m. In the negative case, a random plaintext can be safely 
returned. 

4.3 More Details 

The full proof can be found in the full version [22], but here are the main steps, 
since the proof goes by successive games in order to show that the above decryp- 
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tion simulation is almost indistinguishable for the adversary. Then, a successful 
IND-RCCA adversary can be easily used for inverting the one-way function. 

Go: We first start from the real IND-RCCA attack game. 

G 1 -G 2 : We then simulate the view of the adversary, first, as usual with lists for 
the random oracles and the decryption oracle (see figures |l] and [2]) 
We then modify the generation of the challenge ciphertext, using a 
random mask /*, totally independent of the view of the adversary: 
the advantage of any adversary is then clearly zero. The plaintext 
is indeed unconditionally hidden. 

The only way for any adversary to detect this simulation is to ask F(r*) and 
then detect that the answer differs from any possible /*. We are thus interested 
in this event, termed AskF, which denotes the event that r* is asked to T . 

The main difference with the OAEP 2-round construction, as shown by Shoup 
with his counter-example [28], is that here an adversary cannot make another 
ciphertext with the same r as r*, in the challenge ciphertext, but either by 
chance, or if it had asked for both G{s*) and We now try to show this 

fact. 

G 3 -G 8 : We thus modify the decryption process so that it makes no new query 
to Q and H. The sequence of games leads to the following new rules: 

►Rule Decrypt-noT^ 8 ) 

Choose m {0, 1}*. 

►Rule Decrypt-TnoS® 

Choose m {0, l} e . 

►Rule Decrypt-TSnoR® 

If s = s* but s* has not been directly asked by the adversary 
yet: m £ {0, l} e . 

Else, one chooses m {0, 1 }*, computes / = m ® s and 

adds (r, /) in F-List. 

►Rule EvalGAddW 

For each (t, h) £ W-List and each (to, c) £ R-List, choose an 
arbitrary random p £ R and ask for (c, d = <p p k(t\\h © s, p)) 
to the decisional oracle Same.^ pk . If the record is found (the 
decisional oracle Same Vpk answers “yes”), we compute r = 
t® g and / = to © s, and finally add (r, /) in F-List. 

Some bad cases may appear, which make our simulation to fail. But 
they are very unlikely, we thus can safely cancel executions, applying 
the following rule 
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s 

1 

6 

£ 

5 

o> 

K 

Query F(r)\ if a record (r, /) appears in .F-List, the answer is /. 

Otherwise the answer / is chosen randomly in {0, l} fc and the record ( r , f) is 
added in .F-List. 

Query G(s): if a record (s,g) appears in ^-List, the answer is g. 

Otherwise the answer g is chosen randomly in {0, l} e and the record (s, g) is 
added in 0-List. 

►Rule EvalGAdd (1) 

Do nothing % To be defined later 

Query H(t): if a record (t, h) appears in ?t-List, the answer is h. 

Otherwise the answer h is chosen randomly in {0, l} fc and the record (/,, h) is 
added in Tt-List. 

1 

o 

Pi 

Query X> s k(c): first, if we are in the second stage (the challenge c* as been 
defined), ask for (c, c*) to the decisional oracle Same ¥>pk . In case of positive 
decision, the answer is test. 

Else, for each (m', c') in 27-List, ask for (c, c') to the decisional oracle Same Vpk . 

In case of a positive decision, the answer is the correspondingW. 

Otherwise, the answer m is defined according to the following rules: 

► Rule Decrypt-lnit^ 

Compute t||u = V’sk(c); 

Look up for ( t , h) '£ Tf-List: 

- if the record is found, compute s = u © h. 

Look up for ( s,g ) £ 0-List: 

• if the record is found, compute r = t © g. 

Look up for (r, /) £ .F-List: 

* if the record is found 

►Rule Decrypt-TSR*^ 
h = H{t), 

r = t®g, f = T(r ), 
m = * © /. 

* else 

►Rule Decrypt-TSnoR*^ 

| same as rule Decrypt-TSR (I L 

► Rule Decrypt-TnoS^ 1 ^ 

| same as rule Decrypt-TSR f 1 1 . 

- else 

►Rule Decrypt-noT nj 

| same as rule Decrypt-TSR^. 

Answer m and add (m, c) to ©-List. 


Fig. 1 . Formal Simulation of the IND-RCCA Game: Oracles 
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For two messages (mo, mi), flip a coin b and set m* = mb, choose randomly 

1 

r* then answer c* where 

1 

►Rule Chal (1) 

d 

© 

*6 

ll 

K 

ll 


g* = G(s*), t* = r* ® g* , 


h* =H(t*), u * = s*®h*. 


►Rule ChalC (1) 


and c* = y> p k(£*||w*, p*), for random string p* . 


Fig. 2. Formal Simulation of the IND-RCCA Game: Challenger 

►Rule Abort 1 W 

Abort and output a random bit: 

- If s* has been asked to Q by the adversary, while the 
latter did not ask for 

- If a Decrypt-TSR/Decrypt-TSnoR rule has been applied 
with t = t*, while Ti(t*) had not been asked by the 
adversary yet. 

— If a Decry pt-TSR rule has been applied with s = s*, while 
Q(a*) had not been asked by the adversary yet. 

The remaining bad case (termed AskGHA) is if both s* and t* have 
been asked to Q and % by the adversary. Such a case helps the adversary 
to distinguish our simulation. On the other hand, this case helps to 
invert ip p k. 

Gg: With these new rules for decryption, the simulation of the decryption 
oracle does not use at all the queries previously asked to Q and TL by 
the generation of the challenge, but just the queries directly asked by 
the adversary, which are available to the simulator (we remind that we 
are in the random-oracle model.) One can thus make g * and h* to be 
values independent to the view of the adversary: 

►Rule ChaK 9 > 

The two values r + •*— {0, l} k and f + <— {0, 1 Y are given, 
as well as g + {0, l} fc and h + £ {0,1}^ then r* = r+, 

/* = /+, s* = m* ® /+, g * = g + , t* = r + ® g*, h* = h + 
and u* = s* © h*. 

And then the decryption oracle can be simply replaced by the classical 
plaintext-extractor which looks up in the lists 5-List and W-List (which 
only contain the queries directly asked by the adversary) to obtain the 
values (s, g) and (t, h) which match with c = <£ p k(t||s ® h, p), using the 
decisional oracle Same^, but without using anymore V’sk- In case of 
failure, one answers a random plaintext m. 
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We simply conclude, since our reduction does not use any oracle, but 
can answer any query of the adversary, in an indistinguishable way, 
unless the bad case AskGHA happens: in which case we have inverted 
Psk. 

The time complexity of one simulation is thus upper-bounded by q g qh x 
{T v + Ts ame ), where T v is the time to evaluate one function in the ip family, and 
Tsame the time for the decisional oracle, plus the initial look up in the ©-List: 
Tiu + qdTsame- Thus the global running time is bounded by (including all the list 
look up): 

t' <t + qd,q g qh x {T v + T Same ) + q% x T Same + ( <?/ + q g + qh + Qd) x Tiu- 

In the particular case where <£ p k is a permutation from E onto F (a deter- 
ministic one), one can improve it, using an extra list of size q g qh , which stores 
all the tuples (s,g = G(s),t,h = 'H{t),d = <p p k(t||s® h)). The time complexity 
then falls down to r + q g qu xT v + ( qf + q g + qh + qd) X T\ u . 

5 Conclusion 

All the OAEP variants |28l|6] applied to RSA, with general exponents (i.e., not 
Rabin nor e = 3) admit, in the best cases, reductions to the RSA problem with a 
quadratic loss in time complexity (24| - the original OAEP is even worst because 
of the reduction to the partial-domain case, which requires a more time consum- 
ing reduction to the full-domain RSA problem. Furthermore, for a security level 
in 2~ k , a randomness of 2k bits is required, plus a redundancy of k bits. 

In this paper, we show that the variant of OAEP with 3 rounds admits a 
reduction as efficient as the best OAEP variants (to the full-domain RSA, when 
applied to the RSA family) without having to add redundancy: one can thus 
earn k bits. But this is not the main advantage. 

Considering any criteria, OAEP with 3 rounds is at least as good as all the 
other OAEP variants, but from a more practical point of view 

— since no redundancy is required, implementation becomes easier, namely for 
the decryption process HU; 

— it applies to more general families than just (partial-domain) one-way trap- 
door permutations, but to any probabilistic trapdoor one-way function. It is 
thus safer to use it with a new primitive & 

As a conclusion, OAEP with 3 round is definitely the most generic and the 
simplest padding to use with almost all the encryption primitives. 
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Secret key cryptography was traditionally divided into block ciphers and stream 
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Abstract. In this paper we introduce the concept of generalized lin- 
ear equivalence between functions defined over finite fields; this can be 
seen as an extension of the classical criterion of linear equivalence, and 
it is obtained by means of a particular geometric representation of the 
functions. After giving the basic definitions, we prove that the known 
equivalence relations can be seen as particular cases of the proposed 
generalized relationship and that there exist functions that are gener- 
ally linearly equivalent but are not such in the classical theory. We also 
prove that the distributions of values in the Difference Distribution Table 
(DDT) and in the Linear Approximation Table (LAT) are invariants of 
the new transformation; this gives us the possibility to find some Almost 
Perfect Nonlinear (APN) functions that are not linearly equivalent (in 
the classical sense) to power functions, and to treat them accordingly to 
the new formulation of the equivalence criterion. This answers a question 
posed in [8]. 

Keywords: Boolean functions, linear equivalence, differential cryptanal- 
ysis, linear cryptanalysis, APN functions, S-boxes. 

1 Introduction 

The design criteria for symmetric key algorithms can be traced back to the work 
of Shannon HE where the concepts of confusion and diffusion are formalized. 
Today, a significant number of block ciphers are built by alternating nonlinear 
substitution layers with linear diffusion layers, in the so called Substitution- 
Permutation Networks (SPNs). It has been proved that the usage of sufficiently 
strong substitution functions, or S-boxes, leads to construction of strong block 
ciphers, see for instance the Wide- Trail design technique [5] . The strength of 
each S-box is often measured by means of the resistance to differential [2] and 
linear MM cryptanalysis. 

For a given function / : F p m — » F p n with p prime and m,n> 1 we can build 
the DDT by computing the number 6f(a,b) of solutions x of the equation 

f(x + a) — f(x)=b a G F p m , b G F v n (1) 

The lower the value of the maximum entry in the table, Af = max^o ,&(<5/(a, b )), 
the more robust function / is versus differential cryptanalysis. 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
© Springer- Verlag Berlin Heidelberg 2004 
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In a similar way, we can construct the LAT of / by counting the number 
A f(a, b ) of solutions x of the equation 

a* x = b» f(x) a£F p m ,b£F p n (2) 

where the inner product is indicated with • and gives a value in F p . The ro- 
bustness to linear cryptanalysis is measured with the maximum value Af = 
max 0 ,&^o(||A/(a, b) — p m_1 1|). Good S-boxes have both small Af and Af values, 
and usually have a complex algebraic expression; most of the results focus on 
the case p = 2 which is of interest for practical applications. 

Two functions are said to be equivalent if they differ by a group operation on 
the input or output variables; Lorens m and Harrison mm have considered 
the special case of invertible n-bit vectorial Boolean functions and have derived 
the exact number of equivalence classes (along with asymptotic estimates) for 
n < 5 when different transformations such as complementation, permutation, 
linear and affine transformations are applied on the input and output bits. Sim- 
ilar results can be found in mm regarding the case of Boolean functions with 
5 and 6 input bits and an asymptotic estimate for the number of equivalence 
classes of Boolean functions under the transformation g( x) = f(Ax + b) + L(x) 
(where L is a linear transformation) can be found in [7]. We can say that, in the 
most general case of classical linear equivalence, two functions /, g : F p m — > F p n 
are linearly equivalent if there are two non-singular matrices A, B and a matrix 
C over F p such that 

g(x) = Bf(Ax) + Cx (3) 

The fact that two functions belong to the same equivalence class is rather 
important from a cryptanalytic point of view; it is well known that the distribu- 
tions of values in the DDT and LAT as defined by Q and (J2) are invariant under 
the transformation (|3|). It is also true that if / is invertible, then g(x) = 
has the same cryptographic robustness of / [TS],|2]. This has motivated the fact 
that the inverse of a function is also quoted as being equivalent to it [5]; while 
this is understandable from the point of view of cryptograph^], there is not for- 
mal consistency in the theory, because clearly the operation of inversion is very 
different from the transformation in (TT|) . 

To fill this gap, in Sect. [5] we propose a re-definition of the criterion of linear 
equivalence that permits us to treat the classical case of linear equivalence and 
the inversion operation with a unified approach. The criterion of generalized 
linear equivalence can be applied to functions over finite fields, provided that 
they are represented geometrically by set of vectors in an appropriate linear 
space S. The set of vectors representing function / is denoted with T and called 
the implicit embedding of / (in the space £); the implicit embedding contains 
the information of the truth-table of the function. 


A significant example is that of power functions over F p n , as it happens that the 
inverse of a power monomial is again a power monomial, generally belonging to a 
different cyclotomic coset. 
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Two functions / and g are said to be generally linearly equivalent if Q can 
be obtained from T with an invertible linear transformation T that acts on the 
space S, i.e. Q = T{F). We show that there exist couples of functions that are 
generally linearly equivalent but are not correlated in the classical theory of 
equivalence; thus the proposed criterion is in fact an extension of the classical 
concept of equivalence. 

In Sect. [3] we prove that the cryptographic robustness of a function versus 
differential and linear cryptanalysis is invariant under the transformations con- 
sidered in the framework of generalized linear equivalence, completing the proof 
for the classical case. 

In Sect. 0]we apply the criterion to power functions; we give an example of an 
APN function that is not classically linearly equivalent to any power monomial, 
but is easily obtainable using the generalized equivalence criterion. This answers 
a question posed in [5] . 

Sect. [5] concludes the paper. 


2 Extension of the Linear Equivalence Relation 

2.1 A Geometric Representation 

Let us consider a completely specified function / : F p rn — > F p n , with no restric- 
tions on the values of m, n. There are different possible representations for the 
object /; we are particularly interested in the truth table of /, that lists the 
output values of / associated with the corresponding (actually, all the possible) 
input values. If we view the truth table as a matrix, there are p rn rows, m + n 
columns, and each entry belongs to the field F p . The ordering of the rows is 
not important, in the sense that two truth tables that contain the same rows in 
different order specify the same function and thus can be considered as the same 
truth table. 

We can build a geometric representation of the function in the following way. 
Let S be a linear space of dimension k = m + n, the elements (or vectors) of 
which are defined over the finite field F pm +n . Such vectors can thus be conceived 
both as elements of the extension field F p m+n and as vectors of the space S, 
each vector consisting of m + n components over the basic field F p . Denote by 
+ and • (or nothing) the addition and multiplication of elements in F pm + n ; by 
extension + denotes vector addition in S, and • (or nothing) denotes scalar- 
vector multiplication in S. Consider the set T of p rn vectors in this space formed 
by the rows of the truth-table of /, i.e. the concatenation of the input vectors 
with the corresponding output vectors of /. Formally, 

T = {(*|/(*)), x £ F™, f(x) £ F p n } (4) 

where with | we indicate the simple concatenation of two vectors with compo- 
nents over F p . Each vector of the set represents one complete row of the truth 
table and thus the same information is contained in both representations; since 
the vectors are not ordered, we can see that different orderings of the rows of 
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the truth table, as we would write it down on a piece of paper, actually identify 
the same set of vectors, i.e. the same geometric entity. Two different functions 
have different information in the truth table and therefore they are represented 
with different set of vectors. We conclude that each function / can be unambigu- 
ously represented with a particular set of vectors T , which we call its implicit 
embedding (in the linear space S). 

A natural question is when a given set of vectors actually represents a func- 
tion. The following three conditions must be satisfied: 

1. The set must have cardinality p m for some positive m. In fact, we consider 
completely specified functions, and the number of rows in the truth table 
must be p m if the function has m input variables (belonging to F p ). 

2. The dimension of the vectors must bem + n for some positive n, i.e. the 
function must have at least one output variable. 

3. If we consider the first m components of all the vectors, we must find all 
possible configurations once and only once. This is because there cannot be 
a missing configuration (there would be a missing row in the truth table, 
but the function must be completely specified) and there cannot be multiple 
instances of the same configuration (there would be some missing configura- 
tions because the cardinality of the set is p m ). 

We can see that there are sets of vectors which do not represent functions; 
thus the representation defines a relation from the set of all functions / : F p m —* 
F p n to the set of all the sets of vectors in the space F p m+n that is one-to-one 
but not onto. 

2.2 Linear Transformations Over S 

We have seen that all the information contained in the function specification 
(truth table) is contained also in its geometric counterpart; the shape of the set 
of vectors is thus a unique property of the represented function. If we apply a 
linear transformation of coordinates to the space that is invertible, the infor- 
mation contained in the set of vectors is not changed; instead, we change the 
way we are looking at every geometric object (curves, hyperplanes, etc...) that 
is contained in the linear space S, including the function represented as a set of 
vectors. 

Every invertible linear transformation over the whole space is governed by 
a non-singular (m + n) X (m + n ) matrix T over F p . The non-singularity of 
the matrix assures that we do not loose information while transforming the 
coordinates, and also that the transformation has always an inverse. 

Each vector of the implicit embedding of / is transformed into a new one, 
but the essential shape of the configuration is invariant (we shall study the 
cryptographic invariants of / in Sect. 0. Thus if one vector set is obtained 
from another one by a change of basis governed by matrix T, then the two 
corresponding functions are said to be generally linearly equivalent. 
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Definition 1. Two functions f,g : F v rn — » F p n are called generally linearly 
equivalent \ if and only if the implicit embedding Q of g can be obtained from the 
implicit embedding T of f with 


G = T(F) 

where T is an invertible linear transformation over the space F p m+n correspond- 
ing to the non-singular matrix T. 

We can treat the classical notion of linear equivalence as a particular case of 
the generalized linear equivalence. We first consider the case m> n. Then: 

1 . If matrix T of the change of basis is defined as 



where A is a non-singular mxm matrix and B is a, non-singular nxn matrix 
over F p , then: 

— Matrix T is non-singular 

— If we examine the transformed set of vectors, we see that it still describes 
a function g which has the following relation with function /: 

g(x) = Bf(A~ l x) 

The relation is easy to prove, once we remember that the first m components 
of the vectors in the implicit embeddings of f and g represent the input 
values, and the last n components represent the corresponding output values. 
Thus carrying out the matrix-vector multiplication at block level, we obtain 
y = Ax and g(y) = Bf[x) and substituting we have the above relation 
between / and g. Obviously, if A = I rn (the mxm identity matrix over F p ) 
and B = I n (the nxn identity matrix over F p ) we obtain again / because 
the global transformation is the identity. 

2. If matrix T of the change of basis is defined as 



where A is a non-singular mxm matrix, B is an n x n non-singular matrix 
and C / = 0 is a uxm matrix over F p , then 

— Matrix T is non-singular. 

— If we examine the transformed set of vectors, we see that it still describes 
a function g which has the following relation with function /: 

g(x) = Bf(A~ 1 x) + CA~ x x 


2 We observe that the concept of generalized affine equivalence could be defined along 
the same line, to remove the artificial restriction that if two S-boxes are equivalent 
and one maps 0 to 0, the other must also. 
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Thus we obtain all the functions that are linearly equivalent (in the classical 
sense) to /, according to J3J) . 

3. If matrix T of the change of basis is defined as 



where A / = 0 is as® x m matrix, B is an n X n matrix, C is an n X m matrix 
and D / = 0 is aim x n matrix over F p , then if matrix T is non-singular, we 
can examine the transformed set of vectors. Two possibilities arise: 

(a) It may happen that the transformed set does not describe a function 
anymore because the non-singularity of T does not always imply that 
condition 3 in Sect. 12.11 is satisfied. 

(b) The transformed set satisfies condition 3 in Sect. 12.11 and function g is 
generally equivalent to function /, although it is not obtainable within 
the classical theory. The link between g and / is non-trivial: the out- 
put vectors of g (the last n components of the transformed vectors) are 
obtained by mixing information contained in the input vectors of / by 
means of matrix C and information contained in the output vectors of / 
by means of matrix B. The difference from the previous case is that the 
same thing happens also to the input vectors of g by means of matrices 
A and D. As a result it is not possible to express the relation between 
/ and g with a simple equation as before; nonetheless the two functions 
are generally linearly equivalent. The truth tables of the two functions 
can be expressed as: 

f(x) 

g : Ax + Df(x) — ► Cx + Bf(x) 

Note that the reason why the transformed vector set is still representing a 
function is simply that the function h : x — > Ax+Df(x) is a permutation 
over F p m . 

If m = n holds, the above cases are still valid; however, if it happens that / 
is invertible, more cases can be considered. In particular: 

4. If matrix T of the change of basis is defined as 



where C, D are non-singular m X m matrices over F p , then: 

— Matrix T is non-singular 

— If we examine the transformed set of vectors, we see that it still describes 
a function g, and it holds that: 

g{x) = Cf~ 1 (D~ 1 x) 


On the Generalized Linear Equivalence of Functions Over Finite Fields 85 

This happens because the blocks C, D swap the input and the output parts 
of all the vectors belonging to the implicit embedding of / in the implicit 
embedding of g. Obviously, if C = D = J m we obtain the inverse of /. 
We have thus reduced the operation of inversion of a function to a linear 
transformation over the space where the implicit embedding of the function 
is defined. This is surely a convenient feature of the proposed formulation. 
If matrix T of the change of basis is defined as 



where B / = 0 is am x m matrix and C, D are non-singular m x m matrices 
over F p , then 

— Matrix T is non-singular 

— The relation between / and g is the following: 

g(x) = Cf~ 1 (D~ 1 x) + BD~ 1 x 

i.e. we obtain all the functions that are linearly equivalent (in the classical 
sense) to the inverse of /. 

Last, we consider the case m <n. The following considerations can be made: 

— Cases 1,2,3 are still valid; however in the conditions for case 3 we should 
substitute A / = 0 witB / = 0. 

— Case 4 is not applicable. 

— Under some assumptions for matrix D and function /, case 5 can still be 
valid. However, we loose the relationship with the inverse transformation 
(which is not defined when the numbers of input and output variables are 
different); moreover this case in fact becomes a special instance of 3, thus it 
does not deserve a separate mention. 

In all the remaining cases, either it can be proved that matrix T is singular, 
or the transformed set of vectors cannot represent a function, so we have no 
interest in examining them. 

In the following, an example of a family of functions belonging to case 3 for 
m> n is given. 

Example 1. The family of functions / : F p 2m —> F p rn with p prime and m > 1 
is given, where the input vector x and f(x') are defined as: 

x = (aq) |(a: 2 ) x S F p 2m xi,x 2 € F p m 

f(x) = f((xi)\(x 2 )) = aq 1 + X 2 1 

where we indicate with | the simple concatenation of two vectors (actually, x\ 
and x 2 represented as vectors over F p are concatenated). When function / is 
transformed into function g using a suitable matrix T, we can simply write 
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g = T(f) as the same equation holds for the implicit embeddings of the two 
functions. The implicit embeddings of / and g can be visually represented, along 
with a block decomposition of T; we write explicitly: 


g = T(f) 



X 1 1 + X 2 1 
+ X 2 1 + Xi + X2 


It can be observed that matrix T is non-singular and that the transformed 
set of vectors still represents a function, because the input part (aq) | (aq 1 + x^ 1 ) 
is still a permutation over F p lrn when aq , re 2 vary over F p m (i.e. all the possible 
input values for g are specified in the implicit embedding). We make here the 
underlying assumption that, with an abuse of notation, 0 -1 = 0. 

By Def. Q] the two functions /, g are generally linearly equivalent, although 
there is no way to express the link using the classical theory of equivalence, 
since every function that is classically linearly equivalent to / is obtained with 
a matrix T characterized by a null upper-right block. The truth-table of g is 
written in compact form as 

((aq) | (aq 1 + aq X )) — > (aq 1 + aq 1 + aq + aq) 

Any property that is invariant under the considered transformation is com- 
mon between / and g. In the next Section we present a result on the invariance 
of cryptographic robustness. 


3 Cryptographic Robustness of Generally Equivalent 
Functions 

We start by recalling a fundamental result of the classical theory m, 0 : 

Theorem 1. Given two functions f and g, if they are linearly equivalent i.e. if 
there exist two non-singular matrices A, B such that 

g{x) = Bf(Ax) (5) 

then the distributions of the values in DDTs and LATs of f and g are equal. 

Corollary 1. As a consequence of Theorem UJ we have that Af = A g and 
Af = A g . 

It is also known that the same parameters are conserved when we consider 
the inverse of a function (the DDTs and LATs are merely transposed), or when 
we add a linear combination of the input variables of the function directly to its 
output variables [S’)]. 

Since we proved that these relations are particular occurrences of the general- 
ized linear equivalence, it is therefore natural to ask whether the same parameters 
are also invariant in the general case. We answer with the following theorem. 
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Theorem 2. Given two functions /, g : F p m — » F p n and a non-singular (m + 
n) x (m + n) matrix T over F p , if g = T(f) then the distributions of values in 
the linear and differential tables of f and g are equal. 

Proof. We first prove the relation regarding the DDTs of f and g. 

A cell of the DDT of f located in the i-th row and j-th column contains the 
number of the input vector couples ( x , y) such that y = x+i and f(y) = f(x) +j, 
according to ffffj. 

Thus, if we consider the geometric representation for function f we have that 
the cell contains the number of vector couples (w, z ) belonging to the implicit 
embedding of f such that w = z + k where k = (i)((j) (the concatenation of i 
and j ); note that i £ F p m , j £ F p n and k £ F p m+n . 

These couples will be transformed by the change of basis into other couples 
(■ w',z ') belonging to the implicit embedding of function g such that w ' = Tw, 
z’ = Tz and w' = z' + k' with k' = Tk. 

Since matrix T is non-singular, there is a bijection between the values of k 
and those of k! , i.e. the cells of the DDT of g are just a (linear) rearrangement 
of the cells of the DDT of f. 

A similar reasoning can be applied to prove the relation between the LATs. 

A cell of the LAT table of f located in the i-th row and j-th column contains the 
number of the input vectors x such that i + • x + j + • f(x) = 0, where we denote 
the inner-product with • and, for sake of clearness, the transposed of a vector 
with + . 

Thus, if we consider the geometric representation for function f we have that 
the cell contains the number of vectors w belonging to the implicit embedding of 
f such that k + • w = 0 where k = (i)|(j); note that i £ F p m , j £ F p n and 
k £ F p m+n . 

These vectors will be transformed by the change of basis into other vectors w' 
belonging to the implicit embedding of function g such that w' = Tw. We can 
rewrite the equation as: 

k + • Tw = 0 ( T + k) + • w = 0 <*=> ( k') + »w = 0 

Since matrix T is non-singular, there is a bijection between the values ofk and 
those ofk' = T + k, i.e. the cells of the LAT of g are just a (linear) rearrangement 
of the cells of the LAT of f. □ 

Corollary 2. As a consequence of Theorem^ we have that if f and g are gen- 
erally linearly equivalent, then A g = A; and A g = Af. 

We thus conclude that two generally linearly equivalent functions are charac- 
terized by the same cryptographic robustness; since the general case extends the 
classical relation, we can justify the common robustness of previously unrelated 
functions, such as / and g in Example [T] 

It is a rather computationally difficult problem to decide whether two given 
functions are linearly equivalent: besides exhaustive search on the space of all 
possible matrices, it is possible to classify the functions basing on the distribu- 
tion of values in the Walsh-Hadamard transform. Recently, Fuller and Millan 
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[9] have developed a classification method which exploits the concept of connec- 
tivity between two functions /, g : F 2 n — ► F 2 . They applied the method to the 
case m = 8 and to the Rijndael S-box, being able to prove that all the output 
variables of the only nonlinear step of the algorithm are linearly equivalent. Also, 
a description of optimized algorithms being able to find out whether two given 
invertible S-boxes are equivalent under a linear (or affine) transformation can be 
found in [5] . 

The result of Theorem [5] states that the whole distributions of values in the 
cryptographic tables are equal, not only the maximum values; such information 
could be used as a necessary condition for the generalized equivalence of two 
functions: if the two distributions differ, it can be immediately concluded that 
the two functions are not generally equivalent^. The check of this condition is 
not considered in [5]; we think that the check could speed up considerably the 
algorithms in most cases of negative answer. Obviously the condition is not 
sufficient and further techniques are needed to conclude that the two functions 
are generally (or classically) linearly equivalent. 

It may be useful, at the end of this Section, to give also the geometric meaning 
of the parameters that measure cryptographic robustness. 

In particular, the entries in the DDT of function / represent the number of 
vector couples belonging to the implicit embedding of /, that sum up to the 
same fixed vector, i.e. the (composed) difference vector. We can mentally view 
the process if we figure that the usual parallelogram rule is used to sum the 
vectors, as it would be done in standard Euclidean spaces; in practice, we are 
searching the vector couples that lead to the same path in the space S. This is 
evidently a measure of the redundancy of the information that characterizes the 
particular set of function vectors, i.e. the function itself. 

The entries in the LAT, instead, can be seen as the number of vectors belong- 
ing to the implicit embedding of / that are orthogonal to a given fixed vector, 
since the inner product is the scalar product in S'; the fixed vector is obtained by 
concatenating the masks that are classically applied to the function input and 
output values to compute the LAT. This can also be thought as a measure of 
the redundancy of the directions of the function vectors, and eventually of the 
function itself. 

Finally, note that when the classical notion of linear equivalence is considered, 
we have linear rearrangements of the rows and the columns of the cryptographic 
tables; when generalized equivalence is applied, we have a linear rearrangement 
of the cells within the tables. There may exist couples of functions where the 
distributions of the values in the cryptographic tables are equal, but the actual 
arrangements of the cells cannot be linearly correlated. In these cases we can 
prove that the functions are not generally equivalent if we show that there are 
no possible linear rearrangements of the cells of one table that lead exactly to 
the other table. 


Since the classical equivalence is a special case of the generalized equivalence, the 
two functions are not equivalent also in the classical theory. 
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4 Application of the Criterion to Power Functions 

The set of monomial power functions over F p m is interesting, since significant 
examples of functions with minimum possible Af can be found in this class. 

If p = 2 the minimum possible value for Af when / : {0, l} m — *■ {0, 1}” is 
2 m_n ; functions reaching this limit are called Perfect Nonlinear (PN) [16] and 
exist only for to even and to > 2 n. If we consider the important class of S-boxes, 
i.e. / : {0, l} m — > {0, l} m , then the minimum possible value for Af is 2; functions 
reaching this limit are called Almost Perfect Nonlinear (APN) [IT]. The only 
known examples of APN functions (up to classical linear equivalence) are power 
monomials; the list of known values for the exponent d such that f(x) = x d 
is APN can be found in [8] . Such functions find applications in symmetric key 
cryptography. 

When p > 2 the minimum possible value for Af is 1; functions reaching 
this limit are again called Perfect Nonlinear (PN). There are examples of PN 
and APN power functions over F pm and there is also one known example of a 
function that is not a power monomial but is PN over F 3 m for certain values of 
to [ 8 ]. 

Normally power monomials in even characteristic are classified into cyclo- 
tomic cosets, where a coset contains all the power monomials {x d , x 2d , . . . , 
x 2 ™ d }-. the value d is called the coset leader and the power functions belonging 
to the same coset are classically linearly equivalent. Also, the inverse function 
x d has the same cryptographic robustness of x d , although it (in general) be- 
longs to a different coset and is not linearly equivalent to x d . Cosets, expanded 
with the usual classical equivalence criterion of Eq. [3] constitute the equivalence 
classes of power functions. 

Using the criterion of generalized linear equivalence, different classical equiv- 
alence classes are merged into one: this is the case for instance of the classical 
equivalence classes of x d and x d , since we have shown that in the new formalism 
the operation of inversion is nothing but a special case of linear transformation. 

Moreover, we can show the existence of some functions that are not classically 
linearly equivalent to any power monomial, but still are APN. 

Example 2. Consider the finite field F 2 3 ; the classification of all the possible 
exponents into cyclotomic cosets is given by: 

Co = {0} 

Ci = {1,2,4} 

C 3 = {3,6,5} 

where the cosets C % are numbered accordingly to the coset leader i. Coset Co 
contains only the constant function; coset Ci contains the power monomials that 
are linear; coset C 3 contains non-linear APN power monomials. Since the inverse 
of x 6 is again x 6 and the inverse of x 3 is x 4 5 this coset is its own inversfi 


4 Note that this always happens to the coset that contains the inverse power function 

x _1 which in this case is actually x 6 . 
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Coset C 3 can be expanded into a (classical) linear equivalence class of f(x) = 
x 3 by considering all the functions g(x) such that 



Obviously, all these functions are APN and x 5 ,x e are some members of this 
class. 

Now, consider the function h(x) such that 



where S is the matrix that gives the square of x (x 2 is a linear transformation in 
even characteristic, thus it can be represented by a matrix multiplication). The 
implicit embedding of h, and thus its truth-table, is described by: 


x 3 + x 2 + x — ► x 


This implicit embedding still defines a function because x 3 + x 2 + x is a 
permutation polynomial over F 2 m with m odd, see Corollary 2.10 of m- Since 
matrix T is non-singular, h is generally linearly equivalent to f and thus is APN. 
However, h does not belong to the classical equivalence class that extends C 3 
because all the functions in this class are obtainable from f(x) only using matri- 
ces T with a null upper-right block. We conclude that h belongs to a (classical) 
equivalence class that contains APN functions but is different from that of f(x), 
which is the only one obtainable from power functions over F 2 3 . Both these 
equivalence classes will be merged into one, when the general equivalence classes 
are considered; thus, this is another example of class merging. 

Note that function h can actually be obtained from function / using classical 
means, i.e. by first transforming / into a classically linear equivalent function g 
and then inverting, since: 



However, this does not lead to a function that is classically equivalent to /; 
while this may be difficult to prove classically, it becomes evident when general 
linear equivalence is introduced and one considers that matrix T' cannot belong 
to the family of matrices T indicated in the example. 

5 Conclusions 

In this paper we have presented the criterion of generalized linear equivalence. 
We have shown that the criterion extends the classical notion of linear equiv- 
alence; all the known cases of transformations that lead to invariance of the 
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cryptographic robustness can be treated as special instances of the proposed re- 
lation. Also, it can be shown that there are functions that cannot be correlated 
using the classical theory but become equivalent under the proposed criterion. 
We have used general equivalence to show that there are APN functions that 
are not classically linearly equivalent to power monomials, and that these equiv- 
alence classes are merged under the extended criterion. 

References 

1. Berlekamp, E.R., Welch, L.R.: Weight Distributions of the Cosets of the (32,6) 
Reed-Muller Code. IEEE Transactions on Information Theory, 18(l):203-207, 
1972. 

2. Beth, T., Ding, C.: On Almost Perfect Nonlinear Permutations. Proceedings of 
EUROCRYPT ’93, 65-76, 1994. 

3. Biham, E.: On Matsui’s Linear Cryptanalysis. Proceedings of EUROCRYPT ’94, 
341-355, 1994. 

4. Biham, E., Shamir, A.: Differential Cryptanalysis of DES-like Cryptosystems. Jour- 
nal of Cryptology, 4(l):3-72, 1991. 

5. Biryukov, A., De Canniere, C., Braeken, A., Preneel, B.: A Toolbox for Cryptanaly- 
sis: Linear and Affine Equivalence Algorithms. Proceedings of EUROCRYPT 2003, 
33-50, 2003. 

6. Daemen, J., Rijmen, V.: The Design of Rijndael: AES-The Advanced Encryption 
Standard. Springer- Verlag, 2002. 

7. Denev, J.D., Tonchev, V.D.: On the Number of Equivalence Classes of Boolean 
Functions under a Transformation Group. IEEE Transactions on Information The- 
ory, 26(5):625-626, 1980. 

8. Dobbertin, H., Mills, D., Muller, E.N., Pott, A., Willems, W.: APN functions in 
odd characteristic. Discrete Mathematics, 267(l-3):95-112, 2003. 

9. Fuller, J., Millan, W.,: On linear Redundancy in the AES S-Box. Available online 
on http://eprint.iacr.org, 2002. 

10. Harrison, M.A.: The Number of Classes of Invertible Boolean Functions. Journal 
of ACM, 10:25-28, 1963. 

11. Harrison, M.A.: On Asymptotic Estimates in Switching and Automata Theory. 
Journal of ACM, 13(1):151-157, 1966. 

12. Lorens, C.S.: Invertible Boolean Functions. IEEE Transactions on Electronic Com- 
puters, EC-13:529-541, 1964. 

13. Maiorana, J.A.: A Classification of the Cosets of the Reed-Muller code r(l,6). 
Mathematics of Computation, 57(195):403-414, 1991. 

14. Matsui, M.: Linear Cryptanalysis method for DES cipher. Proceedings of EURO- 
CRYPT ’93, 386-397, 1994. 

15. Nyberg, K.: Differentially Uniform Mappings for Cryptography. Proceedings of 
EUROCRYPT ’93, 55-64, 1994. 

16. Nyberg, K.: Perfect Nonlinear S-Boxes. Proceedings of EUROCRYPT ’91, 378- 
386, 1991. 

17. Nyberg, K., Knudsen, L. R.: Provable security against differential cryptanalysis. 
Proceedings of CRYPTO ’92, 566-574, 1992. 

18. Shannon, C.E.: Communication Theory of Secrecy Systems. Bell System Technical 
Journal, 28:656-715, 1949. 

19. Small, C.: Arithmetics of Finite Fields. Dekker, New York, 1991. 



Sieving Using Bucket Sort 1 


Kazumaro Aoki and Hiroki Ueda 

NTT, 1-1 Hikarinooka, Yokosuka-shi, Kanagawa-ken, 239-0847, Japan 
{maro, ueda}@isl.ntt . co . jp 


Abstract. This paper proposes a new sieving algorithm that employs 
a bucket sort as a part of a factoring algorithm such as the number 
field sieve. The sieving step requires an enormous number of memory 
updates; however, these updates usually cause cache hit misses. The 
proposed algorithm dramatically reduces the number of cache hit misses 
when the size of the sieving region is roughly less than the square of the 
cache size, and the memory updates are several times faster than the 
straightforward implementation. 


1 Introduction 

The integer factoring problem is one of the most important topics for public-key 
cryptography, because the RSA cryptosystem is the most widely used public-key 
cryptosystem, and its security is based on the difficulty of the integer factoring 
problem. Over a few hundred bits, the number field sieve [I] is currently the 
most fastest algorithm to factor an RSA modulus. 

The number field sieve consists of many steps. It is known that the sieving 
step is theoretically and experimentally the most time-consuming step. It is 
noted that a straightforward implementation of the sieving step on a PC causes 
a long delay in memory reading and writing, and the sieving program is several 
dozen times faster if all memory accesses utilize the cache memory. 

This paper focuses on memory access in the software implementation of the 
sieving step on a PC, and introduces an algorithm that reduces the number 
of cache hit misses. The experimental results confirm that the proposed sieving 
algorithm is several times faster than that in the straightforward implementation. 

2 Preliminaries 

2.1 Number Field Sieve 

This section briefly describes the number field sieve algorithm that is relevant to 
the scope of the paper. Details regarding this algorithm can be found in (e.g. [I]). 
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Let iV be a composite number and it will be factored. Find an irreducible 
polynomial f(X) € ZZ\X] and its root M such that f(M) = 0 (mod N). The 
purpose of the sieving step is to collect many coprime pairs (a, b ) G ZZ 1 2 such 
that N R (a,b) = \a + bM\ is B^-smooth and N A (a,b) = \{-b) Ae ^f f{-a/b)\ is 
^A-smootfE]. Such a coprime, (a, b), is called a relation. 

We describe the line-by-line sieve (hereafter we simply referred to as line 
sieve ) as Algorithm [lj and it is the most basic algorithm used to find relations. 
Hereafter, we omit the details on the algebraic side, because very similar algo- 
rithms are used for the algebraic side. Algorithm Q] assumes that 2 H a elements 
are allocated for array S. The sieving region may be divided if 2 H a is greater 
than the suitable size for the implementation platform. The size of each ele- 
ment, S[a], is typically 1 byte, and the base for log p is selected such that it does 
not to exceed the maximum representable value of S[a]. In Step 8 in the inset, 


Algorithm 1 (line sieve for rational side (basic version)). 

1 

for b •*— 1 to Hb 

2 

for all a (—H a < a < H a ). initialize S[a] to log N R (a,b) 

3 

for prime p <— 2 to Br 

4 

Compute a > —H a as the first sieving point depending on b and p 

5 

while a < H a 

6 

S[a] <- S[a] - logp 

7 

a^a+p 

8 

Completely factor N R (a, b) for all a if S[o] < some threshold 


the threshold is determined by considering the error generated by the logarithm 
rounded to the nearest integer in Steps 2 and 6, and the omission of prime 
powersH. 

2.2 Large Prime Variation 

If B r is close to or greater than H a , the while-loop in Step 5 is hardly activated, 
and the first sieving point computation in Step 4 may dominate the sieving time. 
For this case, we can use the large prime variation. The changes compared to 
the basic version are as follows: 

1. Set the bound for p at Step 3 to B^ ( < B R ). 

2. Relax the threshold at Step 8 in Algorithm [T] 

The faster the primality testing and factoring for small integers greater than 
B^ become available, the more relaxed the threshold can become. 

Based on the experience, the most time-consuming part in large prime vari- 
ation is reading and writing to memory to update S[a] in Step 6. This paper 
optimizes the memory read/write process. 


1 “a; is p-smooth” means that all prime factors of x are less than or equal to y. 

2 By regarding prime power p e as prime and logp e as logp, prime powers can be easily 
incorporated into Algorithm [T] 
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2.3 Memory Latency of a PC 

Recent PCs have incorporated cache memory, and cache memory can usually 
be classified into several levels. A low level cache represents fast access but low 
capacity. For better understanding, we provide an example. Let us consider the 
Pentium 4 memory characteristics for logical operations performed by general 
purpose registers as shown in Table [T] 


Table 1. Pentium 4 Northwood 0 p.1-17,1-19,1-20] 



Line size Size 

Latency 

Register 

(4B) 32 B 

| processor cycle 

Level 1 cache 

64 B 8KB 

2 processor cycles 

Level 2 cache 

64B+64B 512 KB 

7 processor cycles 

Main memory 

(4 KB) «1 GB 12 processor cycles + 6-12 bus cycles 


The memory system in a PC is constructed to provide good performance 
for continuous address access, that is, random address access is very poor. A 
line sieve algorithm updates S[o] by step p in Step 6 in Algorithm [TJ When p is 
greater than the size of cache memory, the updates seem to be random access. 
A read from the main memory requires at least 12 + 6 x (2.53/0.533) = 40.5 
processor cycles, where the Pentium 4 frequency is 2.53 GHz and FSB is 533 MHz, 
according to Table Q] However, the user probably feels that the time required 
for main memory access requires more processor cycles. An experiment shows 
that the time for a random read from the main memory requires several hundred 
processor cycles. 

2.4 Previous Work 

Sieving can be considered as waiting for memory because other steps in the in- 
nermost loop are small and very simple, according to Steps 5 to 7 in AlgorithmQ] 
To overcome cache hit misses, 0 proposed the block sieving algorithm. There 
are two differences between the basic version of the line sieve in Algorithm Q] 
and the block sieving algorithm: the addition of Algorithm 0 between Steps 2 
and 3, and the initial p in Step 3 is modified to the smallest prime greater 
than Bft. The block sieving algorithm classifies factor base primes into smallish 
primes (e (0, B s ]) and largish primes (e (B ,s , B L }), and updates each small 
region whose size is H ® by smallish primes. To achieve better performance, 
and Bfi are set to approximately the size of the cache memory. Note that the 
computation of the first sieving point in Step 3 in Algorithm 0 can be omitted 
if the last sieving point computed in Step 4 is available. Focusing on the mem- 
ory hierarchy, the performance of the sieving step may be better optimized in 
order to consider more parameters in classifying smallish primes in some envi- 
ronments. 
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Algorithm 2 (Additional steps from line sieve to block sieving algo- 
rithm). 

1 

for a s * H a to H a step +H% 

2 

for prime p <— 2 to Br 

3 

Compute a > a s as the first sieving point 

4 

while a<a s + H% 

5 

S[o] <- S[o] - logp 

6 

a*~ a + P 


3 Sieving Using Bucket Sort 

The number of cache hit misses for smallish primes greatly decreases using the 
block sieving algorithm described in Sect. 12.41 however, the sieving for largish 
primes still generate many cache hit misses. This section describes the reduction 
in the number of cache hit misses for largish primes using the bucket sorting 
algorithm |U Sect. 5.2.5]. 

As mentioned in Sect. 12.31 memory updates between close addresses are not 
penalized, and the logp minuses which are memory update operations are com- 
mutative. Sorting (a, log p) using key a can reduce the number of cache hit misses; 
however, the sorting should be done very quickly, because the number of S[a] 
updates is roughly 2JJ a (loglogB L — log log B s ), that is, it is almost linear to H a . 
While complete sorting is not required and recent PC models have very large 
memory capacity, we use the bucket sorting algorithm to address this issue. 

3.1 Proposed Algorithm 

The proposed algorithm replaces the largish prime sieving in Algorithm [TJ that 
is, the algorithm has the same function as Algorithm Q] for sieving largish primes. 
The algorithm is based on bucket sorting. Let n be the number of buckets, and 

r be [— 1 , where n s denotes the number of elements in S. Note that n s = 2 H a 
I n I 

for Algorithm [I] The algorithm comprises the continuous rims of Algorithms [3] 
and|H 


Algorithm 3. 

1 

Let all buckets empty 

2 

for prime p <— Br + 1 to B 

3 

Compute a > —H a as the first sieving point 

4 

while a < H a 

5 

Store (a, log p) to the — — J th bucket 

6 

o^o + p 
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Algorithm 4. 

1: for all buckets that are numbered i (0 < i < n) 
2: for all (o,logp) in the bucket i 

3: S[o] <- S[o] - log p 


Algorithm [3] throws (a, logp) in the buckets, and Algorithm [4] updates S[a] 
using the elements in the buckets. 

3.2 Why Can Proposed Algorithm Hit Cache Memory? 

Figure [T] forms the basis for the following discussion. We first consider Algo- 
rithm |U All elements in a bucket will only updates the memory in range r. 
Thus, 

r X (Size of each S[a]) < (Size of cache memory) (1) 

should hold. Next, we consider Algorithm [31 For each bucket, the addresses for 
memory writes are continuous. It is sufficient if 

n x (Size of cache line) < (Size of cache memory) (2) 

holds. Note that the cache memory can only be updated in units called cache 
lines. We assume that the size of (a, logp) is less than the size of a cache line. 
When combining ([1]) and ([2j|. n exists if 

n. x (Size of each s[«]) = (Size of S[.j) < (S^e of cache memory) 2 
(Size of cache line) 

holds. 

Let us consider a typical parameter using Table [TJ The size of the cache 
memory is 512 KB, and the size of the cache line is 128 B. Therefore, the right 
hand side of ([3]) is 2 31 B. If we allocate each S[o] as 1 B, then S can occupy up 
to 2 GB. This means that the proposed algorithm is effective for most PCs. The 
proposed algorithm increases the number of memory accesses, but dramatically 
reduces the number of cache hit misses with appropriate prefetching. 


Ill Pr fT * 


In cache memory when Algorithm [3] ri 
y.t a particular moment 

Buckets 

;ache memory when Algorithm [4] runs 


Fig. 1. Memory usage for buckets and S 
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3.3 Related Work 

[5], which follows the inspiring work [6], independently proposed sieving hard- 
ware, which sorts (a, logp). The paper does not consider the cache memory; 
however, their algorithm is similar in that sieving is converted to sorting. 


4 Optimizations and Improvements 

This section considers optimization techniques and improvements to the pro- 
posed algorithm. 

4.1 (a, logp) Size Reduction 

The size of a stored in a bucket can be reduced, a' = a + H a mod r is sufficient 
to recover a, because a = ir + a' — H a for the itli bucket. 

Moreover, the number of bits for logp can be reduced to 1 bit, because 
( a , logp) can be generated in ascending order on p and logp in a bucket increases 
very slow. 

4.2 Number of Buckets 

For efficient computation of Step 5 in Algorithm [3] and the technique described 
in Sect. 14.11 r should be a power of 2 on most PCs. 

4.3 Hierarchical Buckets 

Considering the idea of radix sort and cache hierarchy, Algorithm 0] can be 
modified to Algorithms 0] and 0] using smaller buckets. 

4.4 Reduction in Memory for Buckets 

Consider the case that a PC does not have enough memory to allocate buckets 
to store all (a,logp)s. Whenever a bucket is full at Step 5 in Algorithm 0J call 
Algorithm 0] and empty the buckets. 

4.5 Reduction in Sieving Memory S 

First, perform sieving for largish primes using Algorithms 0] and 0] When exe- 
cuting Algorithm 0J smallish prime can be sieved between Steps 1 and 2. In the 
ith bucket, a is in [ir — H a , (i+ l)r — H a ). Thus, r elements for S[a] are sufficient 
for the ith bucket. 

Note that this idea cannot be used with the idea described in Sect. 14.41 

4.6 Bucket Reuse for Trial Division 

The trial sieving algorithm [7] was proposed to reduce the time in Step 8 in 
Algorithm Q] The algorithm acts almost the same as the sieving algorithm dis- 
cussed above, but it only considers a small set of (a, b). When filling buckets in 
Algorithm 0J store p in addition to (a, logp), and the buckets can be used for 
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trial sieving. This can reduce the computational cost of the first sieving points 
for largish primes. However, storing p probably doubles the memory allocation 
for the buckets. It may be a good idea to avoid storing small primes that are 
classified as largish primes. 

4.7 Application to Lattice Sieve 

The idea behind the proposed algorithm can be applied to any algorithm if the 
memory update operation is commutative. There are no problems in using the 
proposed algorithm for the lattice sieve. 

4.8 Tiny Primes 

0 p.334] suggests that S[a] is initialized by the logarithm of tiny primes. It can 
be efficiently achieved by the following idea. First, compute the sieving pattern 
for tiny primes, which are less than B T , and their small powers. Once the pattern 
is computed, the initialization of S[a] can be done by duplicating the pattern by 
adjusting the correct starting position. 


5 Implementation on Pentium 4 

We implemented Algorithms [3] and 0] in the lattice sieve using all the techniques 
in Sect. 0] except for Sect. 14.41 and last haf of Sect. 14.11 on a Pentium 4 (North- 
wood) with 1 GB main memory and 533 MHz FSB. The specifications are the 
same as those described in Table [T] The prime bounds are described in Tabled 
These names are from [9] . We tried to obtain the best Bs using the factor base 
parameter for cl58 as described in [TU] . 

Table 2. Prime Bounds and Algorithms 


Range Name Algorithm 

p < B 1 p: Tiny prime Sieving pattern 

B t < p < B s p: Smallish prime Block sieving 
B s < p < B L p: Largish prime Bucket sorting 
B l < p < B p\ Large prime Primality testing and factoring 


5.1 Parameter Selection 

We assign IB for logp and 4B for each (a. logp), because the smallest mem- 
ory read and write unit is 1 B and the basic memory data rmit is 4 B for the 
Pentium 4. 

On the factorization of cl58, the sieving rectangle was 2 H c x H d = 2 14 x 2 13 . 
To translate the rectangle to a line sieve case, we can interpret 2 H a = 2 14 x 2 13 = 

2 27 . The large primes in each relation and the values of B^ and B% are unclear. 

Therefore, we select two large primes for both sides in each relation, and set 

Bft = 30 x 10 6 , B a = 0.9 x Q, and B ^ = B% = 512 x 2 10 , where Q denotes the 
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special-Q according to our factoring code, the primality testing for large prime 
products, factor base bound for the line sieve, and the size of level 2 cache. We 
tried the depths of 1, 2, and 3 for the hierarchical buckets with all powers of 2 
for r, and found that the best hierarchy depth is 2. Surprisingly, the best rs are 
not the combination of the size of the level 2 cache and level 1 cache, but 2 MB 
and 256 KB. 

Next, we tried to find the best B j] and B/j. Based on dozens of experments, 
we find that B^ = 2 H c and = 5 H c achieve almost the best performance. 


Remark 1. 
Remark 2. 

Remark 3. 

Remark 4. 


We sieve prime powers less than VB L , and select B^ = Bj = 5. 

We classify smallish primes into small sets taking into account the 
size of the caches and sieving range. 

After executing Algorithm I3J the numbers of elements in each bucket 
are roughly the same. We found that a 2% difference is the largest 
in our experiments. 

We used base-2 Solovay-Strassen primality testing [TTJ pp.90-91], and 
P HU pp.177-183] and SQUFOF [TTJ pp.186-193] as the factoring 
algorithm for large primes. 


5.2 Factoring Example 

We factor 164-digit cofactor cl64 in 2 1826 + 1 using GNFS, and 248-digit cofactor 
c248 in 2 1642 + 1 using SNFS employing the above implementation. Refer to the 
Appendix for detailed information. The parameters used in the factoring of cl64 
and c248 are summarized in Table [3] For comparison purposes, Table [3] also 
includes the parameters used in the factoring of RSA-512 lEl- 


Table 3. Factoring Parameters for Lattice Sieve 



H c H d 

b r 

B% Bm 

Lax sp-Q #sp -Q #LP ] 

:el/MY 

cl64 

16K 8K 

40 m 

0.95Q4g 

194m 8.2r 

n 2+2 

29 k 

c248 

16 K 8K 

0.95Q 

100m 4g 

200 m 10.2 r 

n 2+2 

22 k 

RSA-512 

4K 5k 

16 M 

16M lg 

15.7m 308 r 

n 2+2 

14k 


k: 10 3 , 

K: 2 10 . 

, m: 10 6 , M: 

2 20 g: 10 9 , G: 

2 30 



rel/MY 

: Generated relations per MIPS ; 

year 



The proposed siever yields more relations per MIPS year despite that cl64 is 
larger than RSA-512. However, a straightforward comparison should be avoided 
because the characteristics of computers used for the above factoring are quite 
different, and MIPS is not optimal for comparing the sieving complexity. 
Remark 1. The lattice siever used for RSA-512 is intended to factor RSA-130 [T31 
Sect. 3.2]. 

Remark 2. We timed MIPS using the output of a “BYTE benchmark.” We 
obtained 3969679.6 lps for Dhrystone 2 without register variables. 
Thus, MIPS is computed by 3969679.6/1767 « 2246.6. This number 
is used for cl64 and c248 in column rel/MY. 
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Remark 3. We noticed that numbers larger than RSA-512 such as RSA-576 
are already factored using GNFS [T3] and that their siever seems 
faster than one that was used for RSA-512. However, not enough 
information is provided to estimate the timings. We used the records 
that were published and the largest values m- 

6 Conclusion 

We proposed a sieving algorithm that cleverly uses the cache memory. The al- 
gorithm accelerates the memory update processes in the sieving step to several 
times faster than that of the simple logp subtraction. Moreover, we implemented 
the proposed algorithm in the lattice sieve on a Pentium 4, and successfully fac- 
tored a 164-digit number using GNFS, and a 248-digit number using SNFS. 
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Appendix: Factoring Parameters and Statistics for cl64 
and c248 

cl64 and c248 are selected from Cunningham table HH- 

cied is the 164-digit cofactor of 2 1826 + 1. 2 1826 + 1 can be trivially factored 
to 2, 1826L x 2, 1826M, where 2, 1826L = 2 913 — 2 457 + 1, and its several factors 
are already known: 

2, 1826L = 997 x 2113 x 10957 x 46202197673 x 209957719973 

x 457905185813813 x 9118425814963735020084050069 
X 758984045239765414366290480154514089 x cl64 
cl64 is factored into two primes, p68 x p97, where 
p68 = 343346448861824465 

46273008924242084634327089789559771215864092254849. 

c248 is the 248-digit cofactor of 2 1642 + 1. 2 1642 + 1 can be trivially factored 
to 2, 1642L x 2, 1642M, where 2, 1642M = c248 = 2 821 + 2 411 + 1. c248 is factored 
into two primes, p88 x pl60, where 

p88 = 75052937460116417664924678548932616036 

64038102314712839047907776243712148179748450190533. 
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cl64poly = 

8293702863045600 x 5 
+ 5627796025215486707 x 4 
4 557524556427309931902111 x 3 
f 176917216602508818430161036 x 2 
- 13601173202899548432935219131949 x 
- 12171622290476241497444980012311021 
M = 411268775932725752596939184846 


c248poly = 

+ 2 x 3 
+ 2 
M = 2 137 


Fig. 2. Polynomials used to factor cl64 and c248 


We used the polynomials described in Fig. [2] to factor cl64 and c248. 

Statistics are summarized in Table 0] CPU years for sieving are converted 
for the Pentium 4 2.53 GHz. Line sieve is used for cl64 factoring, and it yields 
49 m relations. Free relations are not used for both factorings. Linear algebra is 
computed by a 16 PC cluster with GbE using block Lanczos with 128-bit block. 
The Pentium 4 is used for both factoring, but its frequency is about 2.53 GHz 
for cl64 and 3.2 GHz for c248. The programs used for the factoring are basically 
the same except that minor improvements are included for c248. More detailed 
information can be found at pang. 


Table 4. Statistics 


Sieve Linear algebra 


1 CPU years 

Yields 

| Matrix si: 

ze Row weight Calendar days 

cl64 7 

458 m 

7.5m 

167 

12 

c248 8.2 

558 m 

7.4 m 

208 

9.5 
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Abstract. Infinite groups have been used for cryptography since about 
twenty years ago. However, it has not been so fruitful as using finite 
groups. An important reason seems the lack of research on building a 
solid mathematical foundation for the use of infinite groups in cryptog- 
raphy. As a first step for this line of research, this paper pays attention 
to a property, the so-called right-invariance, which makes finite groups 
so convenient in cryptography, and gives a mathematical framework for 
correct, appropriate use of it in infinite groups. 


1 Introduction 

In modern cryptography, many schemes are designed based on groups. The most 
popular problems used for cryptography may be the integer factorization and 
discrete logarithm problems in finite groups. From these problems, many schemes 
have been developed. However, on quantum computer they turned out to be 
efficiently solved by Shor’s algorithms nu. 

Not to put all eggs in one basket as well as to enrich cryptography, peo- 
ple have attempted to use infinite groups for cryptography. Compared to finite 
groups, in infinite groups there are only a few types of schemes (e.g. key agree- 
ment protocol or public key encryption) [24, 9, 21-23, 13, 2] and a few ways 
of analyses of attacks (e.g. deterministic or empirical) [UITU11I31I111II11IH1I3- ^ 
natural question is how we can proceed one more step. An impediment to this 
seems to be connected with “probability” . Indeed, many cryptographic schemes 
have checkpoints concerning probability for their basic security, and many cases 
of cryptanalysis rely on probabilistic analysis. Furthermore, we do not see that 
we can build a provably secure cryptosystem without probability. However, there 
is nothing discussed seriously for it in the literature on infinite-group-based cryp- 
tography. 

Our Results. When cryptosystems are designed or analyzed using infinite 
groups, we sometimes feel attracted to use nice properties or tools which are 
commonly used in finite groups. However, we do not since either it looks wrong 
or we are not sure if it is right or wrong. A possible approach to resolve this 
problem is to extract a nice property of finite groups, to generalize it in arbitrary 
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groups, and then to construct a rigorous theory by which we can decide when 
we can or cannot use this property in infinite groups. 

This paper follows this way focusing on a particular property, the so-called 
right-invariance: we define a probability measure (cf. probability distribution in 
probability theory) P on a group G as right-invariant if P{E) = P(Ex ) for all 
E c G on which P is defined and for all x G G. We show that right-invariance 
property depends on a particular subgroup and the index of the subgroup deter- 
mines when right-invariance can or cannot be used in infinite groups. 

For the situations where this property is allowable, one may be curious about 
how it can be handled in practice. It is easy to find a probability measure which is 
right-invariant only in a particular situation. However, what is more meaningful 
is to find a probability measure which is right-invariant in all situations where 
such property is allowable. Namely, a right-invariant probability measure that 
can be used universally on a given group. As to this, we prove that most infinite 
groups dealt with in cryptography do not have such a probability measure. So we 
discuss weaker, yet practical alternatives with concrete examples. Using these, 
we illustrate how our theory is applied to infinite-group-based cryptography via 
two opposite types of situations. 

Organization. Sec.[2]gives basic notations and brief definitions for reading this 
paper. Sec. |3] discusses why right-invariance is attractive, and formalizes the no- 
tion. Sec. S] explores right-invariance property through building a mathematical 
framework. Sec. |5] discusses the notion of universally right-invariant probabil- 
ity measure and its alternatives. Sec. [H] shows how the results developed in the 
previous sections can be applied to practice. This paper concludes with Sec. 0 


2 Preliminaries 

IN, Z, and 1R denote the sets of all positive integers, all integers, and all real 
numbers, respectively. For a < b, (a, b) = {x £ 1R | a < x < b} and [a, 6] = 
{x 6 IR | a < x < b}. For n e IN, Z„ = (0, 1, . . . , n — 1} and Z* = {a £ Z„ 
gcd(a, n) = 1}. For sets S and T, S\T = {x € S \ x / S 1 }. |S| and 2 s denote 
the cardinal number of S and the collection of all subsets of S, respectively. 
S _1 = {a; -1 | x € S}. A partition of S means a family of non-empty, 

mutually disjoint subsets of S such that S = l MeiSi- 0 denotes the empty set. 

Definition 1. (a) Let M C 2 X for a non-empty set X. M. is called a a -algebra 
in X if (i) 0 6 M, (ii) E g M implies X\E g M, and (iii) U 2 , ... € M 
implies G A4. 

(b) If Ai is a cr-algebra in a non-empty set X, then (X, M) is called a measurable 
space and the members of M. are called the measurable sets in X. 

If S' is any collection of subsets of X, there exists a smallest cr-algebra M. in 
X such that S C M.. This M. is called the a-algebra generated by S. 
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Definition 2. (a) For a measurable space ( X , A4), a set function p : M. — > [0, 1] 
is called a probability measure on M if it satisfies that (i) p(X) = 1 and (ii) 
if Ei, E 2 , . . . G M are mutually disjoint, //(Ug^Ej) = Y^Li h(Fi). 

(b) For a measurable space (X, Ai), if p is a probability measure on M, then 
(X,Ai,p) is called a probability space. In particular, it is called atomic if 
M = 2 X . Measurable sets of a probability space are called events. 

Let G be a group and H a subgroup of G. For x G G, let Z H (x) = [y G H 
yx = xy}, which is a subgroup of H . Hx = {hx \ h G H) is called a right coset 
of H in G and xH = {xh h G H} a left coset of H in G. The index of H in G, 
denoted by [G : H\, is the cardinal number of the set of distinct right (or left) 
cosets of H in G. For a normal subgroup H of G, G/H denotes {Hx x G G} 
and is called the factor group of G over H. 1q denotes the identity of G. 

Definition 3. (a) For a set X, w = wi ■ ■ ■ W( is called a reduced word on X if 
w is the empty word or w satisfies that (i) t G IN: (ii) Wi G X U X -1 for 
all 1 < i < t, (iii) Wi + 1 /^wf 1 for all 1 < i < i. |u;| = 0 (if w is the empty 
word) or l (otherwise) denotes the word length of w. 

(b) F(X) is called the free group generated by X. It is the set of all reduced 
words on X with the binary operation: for any . w 2 6 F(X), w\ ■ w 2 is 
the reduced form of the word obtained by the juxtaposition W 1 W 2 of the two 
words. The symbol is omitted if there is no confusion. 

3 Role of Right-Invariance in Cryptography 

This section shows why this paper selects right-invariance as a useful property. 

Role in Random Self-Reducibility. Informally, a problem is called random 
self -reducible if solving it on any instance is efficiently reduced to solving it on 
a random instance. For a random self-reducible problem, if breaking a crypto- 
graphic scheme implies solving the problem on average, it means solving it in 
the worst case. Thus, since Blum and Micali (4] introduced this notion, it has 
played an invaluable role in showing provable security of many schemes. We refer 
to HUS] f° r detailed references on it and the cryptographic significance of this 
feature. We state it roughly in terms of the discrete logarithm problem with 
proper parameters; a prime p and a generator g of Z*. n is the length of p when 
it is represented in a bit-string. 

Let a, b £ IN and let A be a probabilistic polynomial time algorithm such 
that i 

Pr [A(p,g,g x modp) = x] > — , 
x n a 

where x is taken uniformly at random from Z p _] . Then, there exists a 
probabilistic polynomial time algorithm T> such that for all y G Z p _ i, 


Pr[D(p, g, g v mod p) = y] > 1 - 
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V is built based on the following idea: for any fixed y £ Z p _i, V chooses x £ 
Z p _i uniformly at random, gets w by running A on an input (p, g, g y g x mod p), 
outputs w—x mod p — 1 if g w = g y g x mod p, otherwise repeats this process some 
polynomial times. A basic property used in computing the success probability 
of D is that for any y £ Z p _i 

Pr [A(p,g,g v+X mod p) = y + x mod p — 1] = Pr [A(p,g, g x mod p) = x\, (1) 

where x is taken uniformly at random from Z p _i. 

Equation ([!]) can be generalized as follows: given a group G, for all r £ G 


Pr (f(X) = 0) = Pr (f(Xr) = 0) or 
Pr(/(W)=0)=Pr(/(rW) = 0), 


(2) 

(3) 


where X is a random variable over G and / : G — *■ {0, 1} is a predicate. Without 
loss of generality (WLOG), in this paper we focus on 

If G is a finite group and X has the uniform distribution, (QJ is true. In this 
case, it is being used as an underlying assumption in probabilistically analyzing 
many kinds of cryptographic schemes. However, it is not true in general if G 
is an infinite group or if one cannot uniformly generate elements from even a 
finite group. We know that no probability distribution can ever be uniform on 
any infinite group, however the concept of uniformity makes infinite groups more 
flexibly handled in cryptography. A natural question is what distribution on an 
infinite group is an analogue of the uniform distribution on a finite group. 

For an arbitrary group G, let’s recall the meaning of a random variable. The 
fact that X is a random variable over G with a probability distribution P means 
that P is the probability measure on the atomic measurable space (G, 2 G ) and 
Pr[W £ E] = P(E) for any E C G. In order for (j2j) to hold when G is an infinite 
group, we see it from a measure-theoretic point of view. Namely, we consider not 
only 2 G but also a smaller cr-algebra Q for P. By restricting P originally defined 
on 2 G to G , (G, 2 g , P) induces another probability space ( G,Q,P ). 

Definition 4. Let (G, G, P) be a probability space. E £ Q is called a right- 
invariant event (resp. left-invariant event) if, for all a : £ G, Ex £ G (resp. 
xE £ G) and P(E) = P(Ex) (resp. P(E) = P(xE)). ( G,G,P ) (or shortly P) is 
called right-invariant (resp. left-invariant) if all events are right-invariant (resp. 
left-invariant). 

For a situation in which one is interested (e.g. points where one wants to com- 
pute probabilities or to compare them), if a cr-algebra covering all the events in 
question (i.e. containing all the events in question as its measurable sets) can be 
constructed and there exists a right-invariant probability measure thereon, then 
we say that right-invariance is allowable (or can be used, etc.) in the situation. 

4 Right-Invariant Probability Space 

In order to discuss right-invariance from a measure-theoretic point of view, we 
first analyze the structure of an arbitrary cr-algebra in infinite groups, and then 
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a special type of cr-algebra. From this we formulate a way of deciding whether 
or not right-invariance property is allowable in a given situation. 

Throughout this paper, we deal with only finitely generated groups since 
groups with infinitely many generators are not practical. Note that any finitely 
generated infinite group is a countable set. 

cr-Algebra in Finitely Generated Infinite Groups. Let G be a finitely 
generated infinite group and Q be a cr-algebra in G. For x G G, define 

Mg(x) = {E G G \ x G E} and Mg(x) = n EeMg ^E. 

In particular, denote Mg(lc) by Mg. The following proposition shows that 
Mg(x) is the smallest measurable set containing x. 


Proposition 1 . For a finitely generated infinite group G, let Q be any cr-algebra 
in it. Then, Mg( x) G G for all x € G. Furthermore, any measurable set is 
partitioned into Mg(x) ’s. 

Proof. Let x e G. Since G e Mg(x) and x G Mg(x), Mg(x) / =$. We show that 
Mg (x) can be expressed as an intersection of a countable number of measurable 
sets. For y G G, define a set A y as follows. 


Ay = 


G 

E such that y / (E G Mg(x) 


if 2/e M g (x), 
if y /<Mg(x). 


Since G is a countable set, it suffices to show that Mg(x) = r\ ye cA y . (i) 
Mg(x) C (~l ye aA y : If w /g^gA v , there exists y G G such that w / G\. y . Since 
A y G Mg(x), w / Mg(x). (ii) Mg(x) D D yeG-Ay: If w /Mg(x), w /gAu,. Thus, 
w / Gf^cAy. Therefore, Mg(x) e Q. 

Let E e Q. Since, for any x € E, Mg(x) c E, E = U xe EMg(x). Thus it 
suffices to show that any distinct Mg(x) and Mg(y) are disjoint. Assume Mg(x)f) 
M s{y) /=$• If a; / Mg (y), then Mg (x)\M g (y) G Mg(x) since Mg(x)\Mg(y) G Q 
and x G Mg(x)\M g (y). Since Mg(x) is the intersection of all members of Mg(x), 
Mg(x) C Mg(x)\Mg(y). In particular, Mg(x)C\Mg(y) = 0 which contradicts to 
the assumption. Thus x G Mg(y), so Mg( x) C Mg(y). By the same argument, 
Mg(y) c Mg(x). Therefore, Mg(x) = Mg(y). □ 


Right-Closed cr-Algebra in Finitely Generated Infinite Groups 
Definition 5. A measurable space (G, G) (or a cr-algebra Q in G) is called right- 
closed (resp. left-closed) if, for any E G G and any x G G, Ex G G (resp. xE G G)- 
A cr-algebra generated by a subgroup and all its right cosets is right-closed. 
The following shows that right-closed cr-algebras have only this form. 

Theorem 1 . For a finitely generated infinite group G, the following conditions 
on a measurable space (G, G) are equivalent. 

(i) G is right-closed. 

(ii) Mg(x) = Mgx for all x G G. 

(in) Mg is a subgroup of G, and G is generated by Mg and all its right cosets. 
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Proof. (i)=>(ii): Suppose that (i) holds. Let x G G. Since Mg(x) = f}A&Mg{x)A 
and M g x = (r\ AeMg <j_ G )A)x = ^A£Mg(\. G )( Ax ) = n BeM s ( i a ) x B, it suffices to 
show that Mg(x) = Mg(lc)x. 

Let Ax, where A G Mg{ 1g), be an arbitrary element of Mg(lc)x. Since 
1g € A, x = Iqx G Ax and so Ax G Mg(x ) by (i). Thus Mq{1g)x C Mg(x). 
Conversely, if A G Mg( x), then Iq = xx~ x G Ax -1 G Atg(lG) by (i). Thus, 
Mg(x) C -Mg^e}®. 

(ii) =>(iii): Suppose that (ii) holds. Let a, b G Mg. Since 6 G Mg, Mg = Mg(b) 
by Proposition Q] Then, a G Mg(b) = Mgb by (ii), and so air 1 G Mg. Therefore, 
Mg is a subgroup of G. 

For any E G Q, E = U xeE Mg(:r) by Proposition [lj Mg(x) = Mgx G Q by 
(ii), and so E = U x£ E^lgx. Thus, Q is generated by all right cosets of Mg. 

(iii) =>(i): It is trivial. □ 

Analogous result holds for left-closed n-algebras. By combining these, we get 
the following. 

Corollary 1. For a finitely generated infinite group G, the following conditions 
on a measurable space (G, Q) are equivalent. 

(i) Q is both left- and right-closed. 

(ii) xMg = Mg(x) = Mgx for all x G G. 

(Hi) Mg is a normal subgroup of G and Q is generated by Mg and all its cosets. 

Right-Invariance Property of Finitely Generated Infinite Groups. Right- 
invariance property is what belongs to a probability measure defined on a right- 
closed cr-algebra. When a probability space is right-invariant, any measurable set 
is, of course, right-invariant. Conversely, Proposition!]] and Theorem[T]imply that 
right-invariance of Mg is extended to the whole space. 

Theorem 2. For a finitely generated infinite group G, let Q be a right-closed 
a-algebra in G. P(M g ) = P(M g x) for all x G G if and only if P(E) = P(Ex) 
for all E G G and all x G G. 

From Theorems [T] and [U we have the following. 

Corollary 2. Let G be a finitely generated infinite group. If (G, Q , P ) is a right- 
invariant probability space, then [G : Mg] is finite and P(Mgx) = [G : Mg] -1 for 
all x G G. Therefore, if [G : Mg] is infinite, ( G,Q,P ) cannot be right-invariant 
for any probability measure P. 


5 Universally Right-Invariant Probability Measure and 
Alternatives 

Now we can decide whether or not right-invariance is allowable in a given situa- 
tion. Suppose that it is allowable. Then, what are the concrete examples of the 
probability measure which is both useful and practical for such property? 
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5.1 Universally Right-Invariant Probability Measure 

Given a right-closed measurable space (G, Q), if Mg is of finite-index, it is easy 
to get a probability measure that is right-invariant only on (G, Q). However, 
what is more meaningful is the one that is right-invariant on any right-closed 
(j-algebra Q with finite-index Mg. By Corollary d] it can be defined as follows. 

Definition 6. A probability measure P defined on an atomic measurable space 
(G, 2°) is called a universally right-invariant probability measure on G if P(H) = 
P(Hx) for any finite-index subgroup H of G and any x G G. 

Most infinite groups that have emerged in cryptography are finitely gener- 
ated residually-finite groups (e.g. free groups, groups of automorphisms of free 
groups, braid groups, etc.). A group is residually-finite if the intersection of all 
finite-index normal subgroups consists of only the identity. Here, we consider 
a larger class of groups, finitely generated groups with infinitely many finite- 
index subgroups. Finitely-generated residually-finite infinite groups belong to 
this class. 

Theorem 3. Let G be a finitely generated group with infinitely many finite-index 
subgroups. Then the intersection of all finite-index subgroups of G is a subgroup 
ofG with infinite-index. Furthermore, G has no universally right-invariant prob- 
ability measure. 

Proof. For the proof, we use the following fact. 

Fact 1. Let G be a finitely generated infinite group. Then, for any m G EM, G 
has only finitely many subgroups of index to. 

Let H be the collection of all finite-index subgroups of G and H 0 = fi hzhH. 
Clearly H 0 is a subgroup of G. Assume that [G : H 0 ) = k is finite. Then any 
H gH has index k or less. By Fact [TJ TL is a finite set which contradicts to the 
hypothesis. Therefore, [G : Ho] is infinite. 

Assume that P is a universally right-invariant probability measure on G. 
Then for any x £ G and any H gH, 

P(H 0 x) < P(Hx) = P{H) = [G : H]~ x 

by Corollary [2] Note that for any integer to there exists a finite-index subgroup 
H such that [G : H] > m by Fact [T] and by the hypothesis. Thus P(H 0 x) = 0. 
Since H 0 is an infinite-index subgroup of G, there exist Xi . x?, ■ ■ . G G such 
that G is partitioned into H 0 xi,H 0 X2, — So -P(G) = P(H 0 Xi) = 0 which 
contradicts to P(G) = 1. Therefore, P cannot be universally right-invariant. □ 

Corollary 3. Any finitely-generated residually-finite infinite group has no uni- 
versally right-invariant probability measure. 

5.2 Alternatives 

From Theorem [31 a question arises: what are weaker, yet practical alternatives 
to the universally right-invariant probability measure? We approach this question 
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via random walk on a free group F = F(X), where X = {x \ , . . . , x rn }. It is 
because any finitely generated infinite group is a homomorphic image of a finitely 
generated free group, and random walk yields a natural probability measure on 
F in the following sense: it generates all words of F with positive probability, 
and the longer the word is, the lower its occurrence probability is. 

On the other hand, Theorems [T| and [2] reduce finding such an alternative 
measure to finding an atomic probability measure in an infinite group which is 
close to the uniform distribution over the family of all right-cosets of any finite- 
index subgroup. The latter has been studied independently in group theory for a 
long time. So we attempt to search for alternatives in the results from this area. 

For s £ (0,1), let W s be a no-return random walk on the Cayley graph 
C(F,X ) of F with respect to the generating set X. See Appendix for Cayley 
graph. W s starts at Ip and either does nothing with probability s, or moves 
to one of the 2m adjacent vertices with equal probabilities 1 2 ^ s . If W s is at a 
vertex v / =il, it either stops at v with probability s, or moves with probability 
to one of the 2m — 1 adjacent vertices lying away from 1 p producing a new 
freely reduced word vxf 1 . So Pr(|u; = k) = s(l — s) k and the resulting atomic 
probability measure on F is 



Thus, fj, s (w) is the probability that the random walk W s stops at w. From 
the results of Woess [25] and Borovik, Myasnikov, and Remeslennikov [5], for 
any finite-index subgroup H of F and any x £ F 


lim fi s {Hx) = [F:H]~ 1 . 


On the other hand, for the case that we are working with only sufficiently 
long words, let’s consider a variant of p, , . For k £ IN, define 



where Bj- = {w £ F \ \w\ < k} is a ball of radius k. Then fif. is a probability 
measure on (F. 2 F ). From the results of Pak [18] and Borovik, Myasnikov, and 
Shpilrain [5], for any finite-index normal subgroup H of F 


1 

2 


£ |/l fe (x)-[F: J ff]- 1 |= 0 (e- fe ). 


xeF/H 


Discussion of Property of /x s and p*.. Let (F. T) be a right-closed measur- 
able space with [ F : Mr ] < oo. Suppose that Pjr is the right-invariant probability 
measure on (F, F). Then, by Proposition [T] and Theorem [lj p s has the following 
property. For any E £ F 
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M£) - ME) I = - MM A 


<Y\Fs{Mrx i )-[F-.Mr}~ 1 \ 0 as s — » 0, 


where MrXi’s are distinct right-cosets of Mr in F such that E = l)f =1 MrXi- 
On the other hand, by the normality of H in (UJ, Afc has a slightly different 
property, so that it can be used in two cases. In the first case, let (F,F) be 
a both left- and right-closed measurable space with [F : Mr] < oo. Then, by 
Corollary [T] Mr is a normal subgroup of F. Suppose that P ? - is the right- 
invariant probability measure on (F, F ) . Then, for any E e F 

\ME)~PAE)\ < \ Y |M fe (x)-[F:M^]- 1 | = o{e~ k ) (5) 

xeF/Mr 


for k —> oo. The above inequahty comes from the following fact. 


Fact 2. Let 17 be a finite set, and let Pi and P 2 be probability measures on 
(17,2 fi ). Then, 

max | Pi (F) - P 2 (P) | = \ Y l p iM - AMI- 


In the second case, let (P, F) be a right-closed measurable space such that 
Mr contains a finite-index normal subgroup N of F. Then, there exist distinct 
cosets, Nxi,...,Nx t , of N in F such that Mr = Uj =1 Nxi. Let Pr be the 
right-invariant probability measure on (P, F) . Then, from Fact [2j for any E £ F 

I n k {E)-Pr{E)\< 1 - Y 

<1 Y = o(e~ k ) 

M^xen »= i 

for k —> oo, where 1Z is the set of all right-cosets of Mr in P. 


Discussion of Alternatives. Given a group G, a good alternative to the uni- 
versally right-invariant probability measure may be a probability measure P on 
(G, 2°) such that for any right-invariant probability space (G, G, Pg ) and for any 
E G G, | P(E) — Pg(E) | is very small. Here, we should be careful with the word, 
“small”. Small in what? The factors which determine the value of |P(F) —Pg(E) \ 
come from the characteristics of G, G, and P. Note that the group G is given, 
the fj-algebra Q is arbitrarily selected to some extent, and we are discussing the 
measure P. So focusing on P, it seems more reasonable to view P not as a single 
probability measure but as a family of probability measures indexed by factors 
representing its characteristics. For example, )i = {ps}. 5 e(o.i) and jl = {fikjkeJS- 
From this point of view, let’s define our alternative in general terms. 
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Let P = {P a } aeA be a family of probability measures on (G. 2 G ) for an 
index set A. And let some ccq be given. For any right-invariant probability 
space (G. Q, Pg) and for any E G Q, P has the following property. 

hm \P a (E) - P g (E)\ = 0 

H serves as a good example of this alternative. On the other hand, p can serve 
as another example if ( G,Q,Pg ) is a both left- and right-invariant probability 
space, or if (G. G, Pg) is a right-invariant probability space and Mg contains a 
finite-index normal subgroup of G. In these cases, \P a (E) — Pg(E) | decreases 
exponentially. 


6 Applications 

This section shows two basic examples of how to apply our theory to real situa- 
tions via recent works. These works are based on braid groups. For a survey of 
braid-group-based cryptography, see [TJ . 

For n > 2, the n-braid group B n can be presented by (n — l)-generators 
tJi, . . . , <j n _i and two kinds of relations: 0 , 0 j = OjOi for \i — j\ > 1 and OjOjOi = 
<Jj<Ti<Jj for \i—j\ = 1. For the symmetric group S n on n-letters, there is a natural 
projection it : B n — > S n sending <r ; ; to the transposition (i, i + 1). n(x) is written 
interchangeably with n x . Define P n = ker(7r) and call its elements pure braids. 

6.1 The Case That Right-Invariance Is Not Allowable 

Sibert, Dehornoy, and Girault [5U] proposed entity authentication schemes using 
braid groups: Schemes I, II, II’, III. As a two-pass scheme, Scheme I is perfectly 
honest-verifier zero-knowledge. As three-pass protocols, the other schemes were 
shown to be zero-knowledge under the assumption that the probability space is 
right-invariant (to polynomial-time distinguishers). Their assumption was made 
from some experiment over a certain finite subset of B n . 

This section discusses the security of Scheme II on the whole group B n by 
disproving the assumption for zero-knowledge. Analogous arguments apply to 
Schemes II’, III. Let’s see Scheme II. Prover’s secrete key is z £ B n , and public 
key is (6, b ') e B^ , where b' = zbz~ l . Its three-pass process is given in Fig. Q] 

Assumption for Perfect Zero-Knowledge. For perfect zero-knowledge of 
Scheme II, it is assumed that the distributions of r and rz~ l are identical, where 
r B rl . We show that they cannot be identical by defining a distinguisher A 
as follows. 

A : “On an input x £ B n , output 1 if x = 1b„, and 0 otherwise.” (6) 

Since verifying that any two braids are identical can be done very efficiently, 
A is also efficient. Then the situation comparing the distributions of r and rz~ l 
by using the algorithm A yields the atomic cr-algebra 2 Bn as the right-closed 
cr-algebra in B n . So, right-invariance is not allowable in this situation. 
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Prover 


Verifier 

rG R B n 



x = rbr~ x 

— ®— > 



* 

eGu {0,1} 

_ (r if e = 0, 

V 

x _ ( yby- 1 if e = 0, 

^ { rz _1 otherwise. 


} yb'y _1 otherwise. 


Fig. 1. Scheme II 


Assumption for Computational Zero-Knowledge. For computational zero- 
knowledge of Scheme II, it is assumed that the distributions of r and rz~ l are 
computationally indistinguishable, where r Gr B n . This means that, for any 
polynomial-time distinguisher A, Pr[A(X) = 1] — Pi[A(Xz~ 1 ) = 1]| is negligi- 
ble. Here A is a random variable over B n . 

By using the algorithm ((6]), we show that it is not negligible in the word 
length of the secrete key z with respect to the probability measure /i, which is 
defined on a free group F generated by {si, . . . ,x n -\}. Considering a natural 
projection <f> : F — » B n defined by x t i — xjj, let K = 4r 1 ( 1 /? n ) and let the random 
variable X have the probability distribution induced by fi s . Then 

Pr[A(X) =1] = p s (K) > p a (l F ) = s. 

Let l = min we?i -i( z ) |io|, and let wo G z ) satisfy |iuo| = t- Then 

PrlA^- 1 ) = 1] = fc(fto) = £ Vs(Kw 0 n C k ) = f; s(l - s) t |fa “ nCt| , 
fc = 0 fe =0 I 

where Ck = {w G F \ \w\ = k}. Note that Kwq D Ck = 0 for 0 < k < t. Thus, 

Pr[A(Xz~ 1 ) = 1] = a{l-eY f> -s) fc ° 1 < s(l-s)* = (1-*)*. 

fc= o ' ^ k = o 

Therefore, Pr[A(X) = 1] - Pr \AiXz~ 1 ) = 1] > s - (1 - a) 1 . 


6.2 The Case That Right-Invariance Is Allowable 

For notational convenience, this section assumes that n is even. Define Bp (resp. 
By) be a subgroup of B n generated by oi, . . . , cr n / 2 -i (resp. <J n /- 2 +i- ■ ■ ■ , 
Likewise, define Sp (resp. S u ) be a subgroup of the symmetric group S n gener- 
ated by (1, 2), . . . , (f—1, f ) (resp. (§ + 1, f + 2), . . . , (n— 1, n)). Then, any two 
elements chosen from Bp and B u (resp. Sp and S u ) commute with each other. The 
decisional Diffie-Hellman-type conjugacy problem in B n is defined as follows. 

Given (a, wj l awp, w~ x aw u , x~ 1 xj 1 axpx u ), distinguish x^x^axpXy and 
w~ 1 wj' 1 awpw u , where a G B n , wp,xp G Bp, and w u ,x u G B u . 
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(•F./Ufc) -U ( BtB»,P ) 

I 

^ i — » H i — ► G 

I I I 

IV PeP u t— »1 s<s „ 


Fig. 2. Correspondences among groups 


This problem is used as an underlying problem of a public-key encryption m, 
pseudorandom number generator, and pseudorandom synthesizer 033- Gennaro 
and Micciancio [TO] proposed how to solve it for some parameters. We supplement 
their attack with quantifying the success probability of their adversary. The 
adversary is described as follows. 

A : “On an input (a, wj 1 awg, w~ 1 aw u , x~ 1 xj 1 ax^x u ) 
where a G B n \P n , wt, xt G Bi, and w u , x u G B u , 

1. find any 9 G Sg such that 0 _1 7 r a 9 = 

2. output 1 if 7r (x~ 1 xj 1 ax£x u ) = 9~ 1 Tr(w~ 1 aw u )9, and 0 otherwise.” 

Define B^B U = { xy \ x G B e ,y G B u } and S(S U = {tlo \ r G Si,uj G 5 U }. 
Then they are subgroups of B n and S n , respectively. Let C = Zs e s u (n 0 ). 
Since 6 (at Step 1) can be easily and perfectly computed and such 9 satisfies 
9~ 1 ir(w~ 1 aw u )9 = it ( w~ 1 wj 1 awew u ), the success probability equals 

Pv[A(a,wJ 1 awe,w~ 1 aw u ,X~ 1 aX) = 0] = Pr[7r(X) / &n(wtw u )], (7) 

where X is a random variable over Bf B u . 

Deciding Whether Right-Invariance Is Allowable or Not. Restricting n 
defined on B n to B(B U induces another natural projection n : BfB v — > SfS u . 
Define H = 7f _1 (C') and PiP u = ker(ff). See Fig. jl) Then H is a subgroup 
of BiB u , Pr[7r(X) / ^Jn(w(W u )\ = Pr[X / &lw(W v \, and P?,P U is a normal 
subgroup of BzB u contained in H. Define B as the u-algebra in B(B U generated 
by all cosets of P(.P U ■ Then H G B and B is both left- and right-closed. Since 
[B(B U : Mb] = [BfB v : P(P U ] = ((f)!) 2 is finite, we can use right-invariance 
property in order to compute the success probability Pr[X / £lwiW u ]. 

Computing the Success Probability. Let F = F’({a;i, . . . , x n / 2 -\ , ®n/ 2 +i) • • • , 
x n -\} ) be a free group. Then, there is a natural projection tj> : F — ► BfB u de- 
fined by Xi i —HJi. Let K = 0 _1 (R) and N = </> -1 (P^P„). See Fig. HI Let T be 
the u-algebra in F generated by all cosets of N. Since A is a finite-index normal 
subgroup of F and Mjr = N, fik can be used on (P, T) for right-invariance. 

Define a set function P : B — > [0, 1] by P(E) = p, k ((p~ 1 (E)) for all E G B. 
Since T = {(j)~ 1 (E) \ E G £>}, P is a probabihty measure on (Bf : B u .B). Let the 
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random variable X in m induce P. Then, Pr[X / (Pwt/w n ] = 1 — P(Hwew u ). 
On the other hand, from the definition of P and © 

| P{Hw e w u ) - [B e B u : H}~ 1 \ = | Uk{K(jr l {wtw u )) - [K : N]/[F : NJ| « o{e~ k ). 
Therefore, the success probability of the adversary is 
1 - [B e B u : H]- 1 - o(e~ k ) < 1 - P(Hw e w u ) < 1 - [B e B u : H]~ l + o{e~ k ). 

Note that [B e B u : H] = [S e S u : C] and C = Z Sl s u ( 7r„). So [B t B u : H] can be 
evaluated if ir a is specified. For all a G B n \P n , its upper bound is (n/2)! 2 , and 
lower bound is n(n — 2)/8 for n > 10 from the following theorem. 

Theorem 4. If a G S n \{ls , n }, Zs e s u {°) ' IS a proper subgroup of S(.S U forn > 6. 
Precisely, 

{ n(n — 2)/8 for n > 10, 

3 forn = 8, 

2 for n = 6. 

Proof. Let a G S n , and let a\, . . . , a s be disjoint cycles in S n such that 

! Si for 1 < i < t(, 

S n \SeS u for ti <i< t u , 

S u for t u <i< s, 

for some 0 < t( < t u < s. Let 

a e = a 1 --- a u £St, a = a te+1 * • ■ a tu G (S n \S e S u ) U{l s „}, a u = a tu+1 • - • a s G S u . 
For every 1 < i < s, let on = . . . , with ko = 0. Then 

a = (ai,. . . ,a fcl )(a fel+ i, . . . ,a k2 ) ■ ■ ■ (afe s _ 1+ 1 , . . . ,a fc J. 

Note that for any t G S n , the cycle decomposition of rar -1 is as follows. 
tot - 1 = (r(ai), . . . , T(a fcl ))(r(a fel+ i), . . . , r(o fc2 )) • • • (r(a fc( ,_ 1+ i), . . . , r(a*J) 

Let t G Zs e s u {a). Then toit -1 , . . . , ra s T~ l are disjoint cycles of a. If a* G 
Si, aj G S n \S e S u , and otk G S u , then rajT -1 G St, rctjT -1 G S n \SeS u , and 
TQfcT -1 G for all i,j,k. So ra<r _1 = a^, tot - 1 = a, and ra u r _1 = a u . 
Namely, r G Zs e s u (ae) fl Zs t s u {&) fl Zs e s u (a u ). On the other hand, it is clear 
that Zs e s u (ot() fl Zs e s u (ot) fl Zs e s u (<*«) C Zs e s u (oi). So 

z s e s u (a) = ZseSufat ) O Z SeSu (a) n Z Se s u (oi u )- 
Let a / =g^, and let r = t?t u g S/S/ mean that 7£ g 6/ and r u G S u . 

Case 1. OLia. u /=4d WLOG, let on / =<f n . Define i\ = |{1 < i < n/2 | a^(i) = 
i}\ and li as the number of i-cycles of on for 2 < i < n/2. Then 

n/2 

\zsM)\ = 
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Table 1. Maximum of \Zg t (au)\ and minimum of [St : Zs t (ae)] 


m 

max. of \Zs t {ai)\ 

min. of [Sf.ZsM] 

number of cycles 

3 

3 

2 

4 =t 1, 4 = Q for k 3 

4 

8 

3 

4 = 2, 4 = 0 for k h 2 

> 5 

2 X (f — 2)! 

|(| - 1) 

h = § - 2, 4 = 1, 4 = 0 for k > 3 


Table [T] shows the maximum values of \Zs t {oii)\ and the corresponding val- 
ues of [S( : Z Sl {ott)\ over a n £ 6'^\{ls n }. Since : Z Se s u {(*)] > \SeS u : 

Zs t s u {ote)\ = [S^ : Zs e {ae)], for all a £ S n such that a^a u / 

( n(n — 2)/8 for n > 10, 

[SeS u : Z StSu (a)] > { 3 for n = 8, 

l 2 for n = 6. 


Case 2. aea u = 1 s n '■ In this case, Zs e s u (ot) = Zs e s u {«)• Define 

A e ={l<i<~\a{i)/^, 4, = {~<i<n| «(<)/*}, N e = \A e \, N u = \A U \. 

WLOG, we assume 1 < N u < Ne < n/2. Note that for any T|r« £ Zs,s u (5), 
{{i,rn{i)) | i £ An } is uniquely determined by {(*, t u (i)) \ i £ A u }. So 


\Z Se s u m < (” - Ni)l (| - N U )\NJ < 


{n/2 - l)! 2 

(n/ 2)1 


<|(n/2-l)! 2 


if N u < n/2 , 
if N u = n/2, 

if n > 8, 
if n = 6. 


Therefore, for all a £ N n \{ls n } such that a^a u = l Sn 


[S £ S U : Z SlSu 


(«)] > { 


{n/2) 2 if n > 8, 
6 if n = 6. 


From Cases 1 and 2, the conclusion follows. 


□ 


7 Conclusions 

We know that it is impossible to overestimate the role of the uniform distribution 
in cryptography. However, no infinite group has such a nice distribution. Noticing 
that this fact is an impediment to the use of infinite groups for cryptography, this 
paper has formalized the notion of right-invariance on an infinite group which in 
a sense corresponds to the uniform distribution on a finite set, and then shown 
when and how this notion can be used for infinite-group-based cryptography. 
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Our work is a first attempt to formalize and resolve probability-theoretic 
problems arising in the process of using infinite groups for cryptography. Al- 
though our work cannot resolve all the problems, we hope that it contributes to 
widening the scope of what provably secure cryptosystems can be built on. We 
close this paper with the following research topics. 

— Find different types of alternatives to the universally right-invariant proba- 
bility measure from ours. 

— Find more various examples of practical problems which right-invariance can 
resolve in cryptography. 

— For complex problems (e.g. proving security of a cryptosystem), discover, 
formalize, and solve its constituent problems other than right-invariance. 
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Appendix: Cayley Graph 

The Cayley graph C(G, X) of a group G with a generating set X is a graph such 
that the vertices are in one-to-one correspondence with the group elements and 
there is a (directed) edge from the vertex labelled by v to the vertex labelled by 
vx for each v e G and x € X U A -1 . So if G is an infinite group, its Cayley 
graph is also an infinite graph. The Cayley graph is a metric space by defining 
the length of each edge to be the unit length. The distance between two vertices 
v, w in the Cayley graph is exactly the shortest word-length of v _1 w with respect 
to the given generating set. 
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Abstract. We present new results in the framework of secure multi- 
party computation based on homomorphic threshold cryptosystems. We 
introduce the conditional gate as a special type of multiplication gate 
that can be realized in a surprisingly simple and efficient way using just 
standard homomorphic threshold ElGamal encryption. As addition gates 
are essentially for free, the conditional gate not only allows for building 
a circuit for any function, but actually yields efficient circuits for a wide 
range of tasks. 


1 Introduction 

Homomorphic threshold cryptosystems provide a basis for secure multiparty 
computation in the cryptographic model |FH96llXjTMlCDN01llDN03] . For a given 
n-ary function /, one composes a circuit C of elementary gates that given encryp- 
tions of xi, . . . , x n on its input wires, produces an encryption of f(x i, . . . , x n ) on 
its output wire. The elementary gates operate in the same fashion. The wires of 
the entire circuit C are all encrypted under the same public key; the correspond- 
ing private key is shared among a group of parties. It is customary to distinguish 
addition gates and multiplication gates. Addition gates can be evaluated without 
having to decrypt any value, taking full advantage of the homomorphic property 
of the cryptosystem. Multiplication gates, however, require at least one thresh- 
old decryption to succeed even for an honest-but-curious (passive) adversary. 
To deal with a malicious (active) adversary, multiplication gates additionally 
require the use of zero- knowledge proofs. 

While the result of |FH96| covers the case of a passive adversary only, an inter- 
esting feature is that it covers both the two-party case (n = 2) and the multiparty 
case (n > 2) in a uniform, way. The later papers |.L700l[CDN01IIDN03| do cover 
an active adversary, but only consider the multiparty case. In the present paper, 
we are particularly interested in extending the use of homomorphic threshold 
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cryptosystems to the two-party case. We observe that solutions based on ho- 
momorphic threshold cryptosystems can be used just as well in the two-party 
case. To cover fairness, however, an additional protocol is needed that allows two 
parties to jointly decrypt the outputs in a gradual fashion. We present such a 
protocol by showing how to adapt the decryption step of a homomorphic thresh- 
old cryptosystem. 

A major advantage of secure multiparty computation based on homomor- 
phic threshold cryptosystems is the fact that it results in particularly efficient 
solutions, even for active adversaries. The communication complexity, which is 
the dominating complexity measure, is 0(nk\C\) bits for |JJ001ICDN011IDN03] . 
where n is the number of parties, A; is a security parameter, and \C\ is the number 
of gates of circuit C. A more detailed look at the performance of these solutions 
reveals, however, that there is considerable room for improvement in several 
respects. 

It is assumed in |JJ001lCT)N01llDN03| that the shared key for the homomor- 
phic threshold cryptosystem used in the multiparty protocol is already given. 
As a consequence, the communication complexity of 0(nk\C\) bits does not 
include the communication needed for the distributed key generation (DKG) 
protocol of the underlying threshold cryptosystem. However, the performance 
of the DKG protocol is an issue since we envision a system supporting ad hoc 
contacts among a large group of peer users, where any pair of users may de- 
cide to engage in a secure two-party computation for a dynamically agreed upon 
function. For example, “profile matching” is an application in which two users 
jointly test whether some function of their (personal) profiles exceeds a given 
threshold, without divulging any further information on their profiles. In this 
scenario, it is unreasonable to assume that each pair of users shares a specific 
key pair for the underlying threshold cryptosystem. Instead, each time two users 
want to perform a two-party computation, they would need to rim the DKG 
protocol first. 

In this respect, an advantage of the Mix and Match approach of |JJ00| is its 
applicability to any discrete log setting, whereas |CDN01llDN03] depend criti- 
cally on an RSA-like setting (e.g., using Paillier’s cryptosystem). The advantage 
is that DKG protocols for discrete log based cryptosystems are efficient and 
relatively simple (see |Ped91llGJKR99] h In particular, DKG can be achieved 
practically for free in the two-party case. This contrasts sharply with the known 
protocols for distributed generation of a shared RSA modulus. Briefly, for the 
two-party case (without a helper party), Gilboa |Gil99| reports a communica- 
tion complexity of about 42MB (or 29MB for a slightly optimized version) for 
generating a shared 1024-bit RSA modulus, while covering passive adversaries 
only. And, for the multiparty case, the results of |ACS02] show what is currently 
achievable, also covering passive adversaries only. 

Interestingly, it is actually possible to combine the benefits of a discrete log 
setting and an RSA-like setting, as demonstrated recently in |D.T03j . To this end, 
one uses an amalgam of the ElGamal cryptosystem and the Paillier cryptosystem 
(such a combination has also been presented in the full version of |GS02] h A 
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system supporting ad hoc contacts may then be set up by jointly generating a 
single RSA modulus (between as many parties as deemed necessary, e.g., using 
a robust version of |ACS02] h A discrete log based DKG protocol will suffice 
to generate a shared key between any two users. We do note however that the 
security of the resulting system relies on both a discrete log related assumption 
and a factoring related assumption, which is undesirable from a theoretical point 
of view. 

In this paper, we will focus on a solution for which the security depends 
on the standard decisional Diffie-Hellman (DDH) assumption. As a consequence 
our protocols can be implemented using elliptic curves, for which the security is 
assumed to be exponential as a function of the security parameter rather than 
sub-exponential (as for RSA, for example). The Mix and Match approach of 
[JJOOj is also secure under DDH, but we note that the resulting protocol for 
evaluating multiplication gates is — despite its conceptual simplicity — quite inef- 
ficient. We will show how to evaluate multiplication gates in a much simpler way, 
such that the computational effort decreases by at least one order of magnitude 
(that is, a ten-fold speed-up is achieved, see Section l3dl) . On the other hand, a 
disadvantage of our approach is that, in general, the round complexity is 0(nd ) 
for n parties and circuit depth d = d(C), versus 0(n+d) for Mix and Match. For 
two-party computation, however, the round complexity is 0(d) in both cases, 
and more generally for small n the gain in computational efficiency outweighs 
the increased round complexity. 

The basis of our approach is formed by the conditional gate, a special multipli- 
cation gate which we show to be efficiently implementable under DDH. Basically, 
a conditional gate allows us to efficiently multiply two encrypted values x and y, 
as long as x is restricted to a two-valued domain, e.g., x G {0, 1}. We emphasize 
that the value of y is not restricted, e.g., we may have y G Z q , where q is a large 
prime. This property can be exploited when designing circuits for specific func- 
tions. For example, from the formula ( y' 0 , y[) = (y 0 - x(y 0 - y{) , y\ + x(y 0 -yi)), 
with x G {0,1}, one sees that a conditional swap gate, swapping any two values 
in Z g depending on the value of x, can be obtained using a single conditional 
gate. We will indicate that, using ElGamal, one cannot expect to achieve a mul- 
tiplication gate for which both inputs are unrestricted. Note, however, that the 
result of ICDNOIj shows that multiplication of two unrestricted values can be 
achieved efficiently under a factoring related assumption. 

Overview. Throughout the paper we will describe the results in a general set- 
ting of n-party computation, n > 2, although we are mainly interested in the 
two-party case. In Section [5J we review the basics for homomorphic threshold 
ElGamal. In Section [3] we introduce the conditional gate as our elementary mul- 
tiplication gate, and we show how it can be used to achieve xor-homomorphic 
ElGamal encryption efficiently. In Section 01 we then consider the secure eval- 
uation of arbitrary circuits, following [CDNOlj . which we extend with a new, 
non-interactive protocol for achieving private outputs. Furthermore, we propose 
an efficient protocol for achieving fairness in the two-party case. In Section EE 
we show that particularly efficient circuits can be built for basic operations such 
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as integer comparison, paying special attention to Yao’s well-known millionaires 
problem in Section 15.21 for which we obtain a solution requiring 12m exponenti- 
ations for m-bit integers. Finally, in Section [SJ we conclude with future work and 
give an example of a more advanced application which we call ‘profile matching’. 


2 Preliminaries on Homomorphic Threshold ElGamal 

Discrete Log Setting. Let G = (g) denote a finite cyclic (multiplicative) group of 
prime order q for which the Decision Diffie-Hellman (DDH) problem is assumed 
to be infeasible: given <? a , ff 7 £r G, it is infeasible to decide whether afi = 7 
(mod q). This implies that the Diffie-Hellman (DH) problem, which is to compute 
g a 0 given g a . g® Gr G, is infeasible as well. In turn, this implies that the Discrete 
Log (DL) problem, which is to compute log ff h = a given g a Gr G, is infeasible. 

Homomorphic ElGamal Encryption. For public key h £ G, a message m £ Z q 
is encrypted as a pair ( a,b ) = (g r ,g m h r ), with r £r Z g . Encryption is addi- 
tively homomorphic: given encryptions (a,b), (a' ,b') of messages to, m! , respec- 
tively, an encryption of m + m! is obtained as (a, 6) * ( a',b ') = (aa',bb') = 
(g r+r ',g m+m 'h r+ r '). 

Given the private key a = log g h, decryption of (a,b) = (g r , g m h r ) is per- 
formed by first calculating b/a a = g rn , and then solving for m £ Z q . In general, 
this is exactly the DL problem, which we assume to be infeasible. The way out 
is to require that message m is constrained to a sufficiently small set MCZ,0 
In this paper, the cardinality of M will be very small, often \M\ = 2. 

Homomorphic ElGamal encryption is semantically secure assuming the in- 
feasibility of the DDH problem. Throughout the paper, we use [m] to denote 
the set of all ElGamal encryptions of to under some understood public key h, 
and, frequently, we also use [to] to denote one of its elements. More formally, 
using that [0] is a subgroup of G x G, [to] is the coset of [0] in GxG containing 
encryption (1, g m ). Hence, encryptions (a, b) and (a', b') belong to the same coset 
iff \og ;j (a/a') = log h {b/b'). Lifting the operations on the direct product group 
GxGto the cosets, we thus have, for x,y £ Z q , that [a:] * [y] = \x + y], and 
[xp = [xy], where (a, b) c = ( a c ,b c ) for c £ Z q . Hence, [x] * [y] _1 = [x - y]. 
Addition and subtraction over Z q and multiplication by a publicly known value 
in Z q can thus be performed easily on encrypted values. These operations are 
deterministic. Another useful consequence is that any encryption in [x] can be 
transformed into a statistically independent encryption in [x] by multiplying it 
with a uniformly selected encryption in [0] ; this is often referred to as “random 
re-encryption.” 

Pedersen Commitment. Given h' £ G, a Pedersen commitment to to G Z, is a 
value b = g m h ,r , with r £r Z q . The commitment is opened by revealing to and r. 


1 For intervals M, the Pollard-A (“kangaroo”) method runs in 0(^/\M\) time using 
0(1) storage. 
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Pedersen’s scheme is unconditionally hiding and computationally binding, under 
the assumption that log g h! cannot be determined. The commitment scheme 
is also additively homomorphic, and we will sometimes use ((m)} to denote a 
commitment to message m, where the randomization is suppressed. 

E-Protocols. We briefly mention a few facts about 77-protocols. A 17-protocol 
for a relation R = {(», w)} is a three-move protocol between a prover and a 
verifier, where the prover does the first move. Both parties get a value v as 
common input, and the prover gets a “witness” w as private input, (v, w) G R. 
A 77-protocol is required to be a proof of knowledge for relation R satisfying 
special soundness and special honest-verifier zero-knowledge. See |CDS94] for 
details. 

We need some well-known instances of 17-protocols. The simplest case is 
Schnorr’s protocol for proving knowledge of a discrete log a, on common input 
a = g a , and Okamoto’s variant for proving knowledge of a, /3, on common input 
a = g a h,P . Another basic case is Chaum-Pedersen’s protocol for proving knowl- 
edge of a, on common input (a, b) = (g a ,h a ), which is a way to prove that 
(a, b ) G [0] without revealing any information on a. Applying OR-composition 
|CDS94| . these basic protocols can be combined into, for instance, a 77-protocol 
for proving that (a, b ) G [0]U[1], where the common input is an ElGamal encryp- 
tion (a, b). The latter protocol thus proves that the message encrypted (which is 
an element of Z 9 ) actually is a “bit”, without divulging any further information 
on the message. 

For simplicity, we will use the non-interactive versions of these i7-protocols, 
which are obtained via the Fiat-Shamir heuristic, that is, by computing the 
challenge as a hash of the first message (and possibly other inputs) . The resulting 
proofs are known to be secure in the random oracle model; in particular, we will 
use that these proofs can be simulated. 

Threshold ElGamal Decryption. We use a (t + 1, n)-threshold ElGamal cryp- 
tosystem, 0 < t < n, in which encryptions are computed using a common public 
key h (as above) while decryptions are done using a joint protocol between 
n parties P\ .... , P n . Each party P* holds a share G Z 9 of the private key 
a = log g h, where the corresponding value hi = g ai is public. As long as more 
than t parties take part, decryption will succeed, whereas t or less parties are 
not able to decrypt successfully. 

The parties initially obtain their shares cq by running a secure distributed 
key generation protocol; see |Ped91l[GJKR99| for details. We note that these 
protocols are practical (the communication complexity is 0(n 2 k) bits for security 
parameter k, where the hidden constant is small). For the two-party case (t = 1, 
n = 2), we briefly describe a (non-robust) distributed key generation protocol in 
the spirit of |GJKR99] . The protocol consists of two steps. In the first step, party 
Pi, i = 1,2, broadcasts a Pedersen commitment bi = g ai h' ri , with a t , Gr Z ? 
along with a proof of knowledge for a,, r. L . In the second step, party P t , i = 1,2, 
broadcasts r,; along with a proof of knowledge of log ff h t , where hi = bi/h ,Ti . The 
joint public key is h = hih- 2 , with private key a = ai+Oi 2 ■ Clearly, this protocol is 
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very practical. In many cases, it may even be replaced by the trivial one-round 
protocol in which both parties broadcast hi = g a< - and a proof of knowledge 
of oti- Although the trivial protocol allows one of the parties to influence the 
distribution of the public key h slightly, this need not be a problem for the 
application in which the key is used; see |GJKR03] for more details. 

For decryption of (a, 6), party Pj, i = 1 . . . . , n, produces a decryption share 
di = o ai along with a proof that log a di = log g hi. Assuming w.l.o.g. that parties 
Pi, . . . ,Pt+i produce correct decryption shares, the message can be recovered 
from g m = b/a a , where a a is obtained from d -\ , . . . ,d t + 1 by Lagrange interpo- 
lation. Assuming homomorphic ElGamal, rri G M will hold for some small set 
M; if such m cannot be found decryption fails. Also, if fewer than t + 1 parties 
provide a correct decryption share, decryption fails. 

For later use in the proof of TheoremjTJ we note that the threshold decryption 
protocol can be simulated for any input (a, b ) e |m] , provided message m e Z, 
is given as well. Assume w.l.o.g. that parties Pi, . . . , P t are corrupted, hence col- 
lectively form the adversary. The simulator first extracts the shares ai, . . . , at 
of the adversary, by rewinding the proofs of knowledge based on these shares. 
(The parties prove knowledge of their shares during the distributed key gener- 
ation protocol.) The simulator then computes a a = b/g m from b and m. The 
simulator then computes the correct decryption shares for the corrupted parties 
as a ai , . . . , a ° L , which enables the computation of the decryption shares for the 
honest parties by Lagrange interpolation on a a , a ai , . . . , a“*. The corresponding 
proofs of correct decryption are simulated for the honest parties. For the cor- 
rupted parties, the decryption shares and the proofs of correct decryption are 
obtained from the adversary, running it as a black box; possibly some of these 
shares are wrong and/or some of the proofs fail, but these values are included 
in the output of the simulator anyway. The simulation is then completed by 
recovering the message as in the real protocol, possible ending with a decryption 
failure. As a result, the simulated transcript is consistent with the view of the 
adversary and statistically indistinguishable of real transcripts. 


3 Special Multiplication Protocols 

The results of the previous section imply that a function / can be evaluated 
securely in a multiparty setting if / can be represented as a circuit over Z g con- 
sisting only of addition gates and simple multiplication gates. Here, an addition 
gate takes encryptions [a;] and [y] as input and produces [x] * |y] = [x + y] 
as output, and a simple multiplication gate takes |x] as input and produces 
[x] c = {ex] as output, for a publicly known value c £ Z q . To be able to handle 
any function /, however, we need more general multiplication gates for which 
both inputs are encrypted. 

In this section, we consider two special multiplication gates. If no restric- 
tions are put on x or y, a multiplication gate, taking |x] and [y] as input and 
producing [xy] as output efficiently, cannot exist assuming that the DH problem 
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is infeasibleH Therefore, we consider two special multiplication gates, putting 
some restrictions on the multiplier x. The first gate requires that the multiplier 
x is private, which means that it is known by a single party. The second gate, 
referred to as the conditional gate, requires that the multiplier x is from a di- 
chotomous (two-valued) domain. As a direct application of the conditional gate, 
we also consider xor-homomorphic encryption based on ElGamal encryption. 

3.1 Multiplication with a Private Multiplier 

We present a multiplication protocol where the multiplier a; is a private input 
rather than a shared input. That is, the value of x is known by a single party 
P. No restriction is put on the multiplicand y. Multiplication with a private 
multiplier occurs as a subprotocol in the protocol for the conditional gate and 
in other protocols further on in the paper. 

Given encryptions fa;] = (a,b) = (g r ,g x h r ) and [y] = (c, d), where party 
P knows r, x, party P computes on its own a randomized encryption {xyj = 
(e, /) = ( g s , h s ) * fy] x , with s Z g , using the homomorphic properties. Party 
P then broadcasts [xyj along with a proof showing that this is the correct output, 
which means that it proves knowledge of witnesses r, s, x € Z g satisfying a = g r , 
b = g x h r , e = g s c x , f = h s d x . 

For later use, we need to be able to simulate the above protocol. The simulator 
gets as input [xj and M, and a correct output encryption \xy\, but it does 
not know x. As a result, the simulator only needs to add a simulated proof of 
knowledge. The simulated transcript is statistically indistinguishable from a real 
transcript. 

Below, we will also use a variation of the above protocol, where the private 
multiplier x is multiplied with several multiplicands y, at the same time. Fur- 
thermore, we note that often a slight optimization is possible by using a Pedersen 
commitment ((x)} = g x h' r instead of an ElGamal encryption |x] = (g r , g x h T ) for 
the multiplier. 

3.2 Conditional Gate 

Next, we consider a multiplication gate for which the multiplier x is from a 
dichotomous (two-valued) domain, whereas the multiplicand y is unrestricted. 
We call it the conditional gate, and show how to implement it by an efficient 
protocol, using just homomorphic threshold ElGamal. We will formulate the 
conditional gate for the dichotomous domain {— 1, 1}H 


2 Given g x ,g y we form encryptions [a;], [y] and feed these into the multiplication gate. 
The gate would return an encryption \xy\, which would give g xy upon decryption. 

3 Domain {0,1} or any other domain {a, b}, a ^ b, can be used instead, as these 
domains can be transformed into each other by linear transformations: a; h- > a' + 
(b' — a')(x — a) / (b — a) maps {a, 6} to {a', 6'}. These transformations can be applied 
directly to homomorphic encryptions, transforming [a:J with x 6 {a, b} into [a/] with 
x'e{a',b'}. 
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Let [x|, [y] denote encryptions, with x £ {—1,1} C Z q and y £ Z q . The 
following protocol enables parties Pi, ... , P n , n > 2, to compute an encryption 
ta:y] securely. For simplicity, we assume that these parties also share the private 
key of the (t + 1, n)-threshold scheme [■], where t < n. The protocol consists of 
two phases. 

1. Let xo = x and yo = y ■ For i = 1, . . . ,n, party P* in turn takes [ajj_i] and 

as input, and broadcasts a commitment ((s*)), with Sj £r {—1,1}. 
Then Pj applies the private-multiplier multiplication protocol to multiplier 
({si}} and multiplicands fa:j_i] and [j/j_i], yielding random encryptions Jaq] 
and [j/J, where x» = SiXi-i and y, = \ . If Pj fails to complete this step 

successfully it is discarded immediately. 

2. The parties jointly decrypt [a: n ] to obtain x n . If decryption fails because 
the number of correct shares is insufficient, the entire protocol is aborted. If 
decryption fails because x n / £ {3-, 1}, each party Pi is required to broadcast 
a proof that s* £ {—1,1}. Parties failing to do so are discarded, and the 
protocol is restarted (starting again at phase [lj. Given x n and [y n ], an 
encryption [a;„y„] is computed publicly. 

The output of the protocol is [a;„t/„]. Clearly, if all parties are honest, x n y n = 

(IL=1 s i) 2x v = x v- 

Any party may disrupt the protocol for at most one run of phased] by picking 
a value s* outside the range {—1, 1}. Note that we do not need to require that 
each Si is in {—1, 1} in phased! For instance, parties Pi and P 2 may cheat by 
setting si = 2 and S 2 = 1/2. Since S 1 S 2 = 1, this type of “cheating” will go 
unnoticed in phase [2] if all other parties are honest. However, the security of the 
protocol is not affected by such “cheating.” For t < n/2, the protocol is robust, 
allowing up to t failing parties in total (as the threshold decryption step tolerates 
up to t failing parties). For n/2 <t<n, the protocol is not robust, but we will 
see from Theorem d] below that the adversary does not get an advantage in this 
case. 

The protocol requires a single threshold decryption only. Since x n £ {—1, 1} is 
required to hold, decryption is feasible for the homomorphic ElGamal encryption 
scheme. As the value of x n is statistically independent of x, the value of x n does 
not reveal any information on x. This is stated in the following theorem, which 
holds for up to t < n corrupting parties. 

Theorem 1. On input [x],[y] with x £ {—1,1} C Z q and y £ Z q , the above 
protocol produces \xy\, without leaking any additional information on x and y. 

Proof. The soundness of the proofs in phased] of the protocol ensures that x n = 
x n"=i s i anf l Vn = V n"=i s i Since it is checked in phase |2]that x n £ {—1, 1}, it 
follows from x £ {—1, 1} that n"=i Si e { 1 • 1} as well- Therefore, x n y n = xy. 

To argue that no additional information on x and y is leaked we present the 
following simulation of the protocol. The simulation takes as input encryptions 
M* [j/]> arl( l [ xy\. Given this information, the simulator is able to generate a 
complete transcript for the protocol, for which the distribution is exactly the 
same as in real executions of the protocol. If \xy\ is not available, it may be 
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replaced by a random encryption in |0], as done in |CDNflH -Theorem 1], Since 
the simulator below does not use the shares of the honest parties to simulate 
decryptions, the simulated transcripts will be indistinguishable (under DDH) 
from real transcripts for any adversary controlling up to t parties. 

Assume that parties Pi, ... ,P t are corrupted, hence collectively form the ad- 
versary (the simulator is easily adapted for other sets of corrupted parties) . The 
simulator lets the adversary run phase H] of the protocol for parties Pi, . . . ,P t , 
each time rewinding the proofs of knowledge used in the private-multiplier mul- 
tiplication protocol to extract the values si, . . . , St; if a party fails to provide a 
correct proof it is discarded. Subsequently, the simulator runs phased] for parties 
Pt+i, . . . , P„_ i as in the real protocol, leaving with x n -\ = s\ - ■ ■ s n -ix, 

as intermediate encryption. For party P„, however, the simulator picks s' n Gr 
{—S,S}, where S = s h and it computes a commitment ((s' n x n _ i}} and an 
encryption from and \xy\, respectively. Writing s n = s' n x n - 1 , the 

simulator then simulates the private multiplier multiplication protocol for mul- 
tiplier ((s n )) and multiplicands [a; n _i], [y n -i] and outputs |#^|, [s^asy], which 
are the correct outputs since s' n = s n x n -\ and s' n xy = s' n x n -iy n -i = s n y n -\. 

The output of phase [T] consists of encryptions |s y n J and By construc- 

tion, the simulator is able to perform the decryption in phase d] itself, producing 
s' n £ {—S, S} as output. The simulator for the threshold decryption protocol 
is used for encryption [s(J using s' n as an additional input (see Section d]) . If 
decryption fails due to an insufficient number of correct decryption shares, the 
simulation stops, as in the real protocol. If S' / £ {hi}, decryption fails and a 
proof that .s, G {—1,1} is generated for each party P*, by letting the adversary 
do this for parties Pi, ... , Pj (of which at least one fails) , running the real pro- 
tocol for parties Pt+i, . . . , P n - i, and using a simulation for P„. After discarding 
the failing parties among P\ ..... Pt, the simulation is continued by simulating 
another run of phase HI 

Finally, the simulator computes the encryption {s' n s' n xy\ = [a:j/], which is 
clearly the correct output. □ 

If the total number of parties is large compared to the total number of condi- 
tional gates to be evaluated, an alternative way to guarantee robustness is to let 
the parties use encryptions [s*] instead of commitments {(sj)} in phased] Again, 
if x n /£ {T 1} in phased] all parties are required to prove that s; £ {—1,1}. 
Failing parties are discarded and their s* values are decrypted to correct the 
value of x n . 

The performance of the protocol is as follows (analyzing the case that no 
party is cheating). The performance is determined by the communication com- 
plexity (in bits) and the round complexity. In phase 1 each party applies the 
private-multiplier multiplication protocol, broadcasting about 10 values. For de- 
cryption each party broadcasts 3 values at the most. Hence, the communication 
complexity is 0(nk) where the hidden constant is very small. In general, the 
round complexity is 0(n), which is high, but in case of two-party computation 
it is 0(1). Also, when many conditional gates are to be evaluated in parallel, 
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one may take advantage of the fact that the order in which parties Pi, ... ,P n 
execute phase 1 of the conditional gate protocol can be chosen arbitrarily. 

3.3 XOR-Homomorphic ElGamal Encryption 

As a direct application of the conditional gate, we obtain an xor- homomorphic 
ElGamal encryption scheme. (The converse problem of constructing (Z g ,+)- 
homomorphic schemes, q > 2, from xor-homomorphic schemes, such as the 
Goldwasser-Micali cryptosystem |GM84| , is considered in |KMQ01j .) 

Given [a;], [y] with x, y £ {0,1}, [a; ® y] is computed as follows, using one 
threshold decryption (cf. footnote [2]) : 

1. Publicly convert [a:] to [a; 7 ] with x' = 2x — 1 G {— 1,1}. 

2. Apply the conditional gate to [a/] and [y] to obtain [a :'y\. 

3. Publicly compute \x — x'y\, which is equal to \x ® y]. 

The work per party is very limited, about 13 exponentiations for each con- 
ditional gate. In contrast, the Mix and Match approach of |.T.T0fl| would require 
each party to mix the 4 rows of a truth table for x ® y in a verifiable way (Mix 
step, requiring 24 exponentiations for blinding the entries and, say, 6 x 12 ex- 
ponentiations for the correctness proof, using the efficient protocol of |Gro03| ). 
and perform on average 4 plaintext equality tests to find [a; ® y] given [a:] and 
[y] (Match step, requiring 4x7 exponentiations). Hence, the conditional gate 
provides approximately a ten-fold improvement, counting exponentations. 

4 Circuit Evaluation 

In this section, we briefly describe a protocol for evaluating a given circuit com- 
posed of elementary gates. Recall that our elementary gates operate over Z g , 
except that the first input of a conditional gate is required to belong to a two- 
valued domain. It is clear that these elementary gates suffice to emulate any 
Boolean circuit. Specifically, any operator on two bits x,y £ {0, 1} C Z q can 
be expressed uniquely as a polynomial of the form ao + a\x + ayy + ayxy with 
coefficients in Z g . Hence, any binary operator can be expressed using at most 
one conditional gate. 

The protocol operates in much the same manner as the protocol for circuit 
evaluation of, for instance, |GDN01] . For convenience, we assume that the parties 
Pi, ... ,P n evaluating the circuit are exactly the same as the parties for which 
the ( t + l,n) -threshold cryptosystem has been set-up, where t < n. The circuit 
is then evaluated in three phases: 

1. The parties encrypt their inputs using the homomorphic cryptosystem [•], 
and the parties are required to provide a proof of knowledge for their inputs, 
and possibly that the inputs belong to a dichotomous domain. 

2. The parties then jointly evaluate the circuit gate-by-gate. Conditional gates 
at the same depth of the circuit are evaluated in parallel. 

3. Finally, the parties jointly decrypt the outputs of the circuit. 
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As described in the previous section, parties failing at some stage in the 
protocol are discarded immediately. As long as no more than t < n/2 parties 
fail in total, the protocol will complete and all parties will learn the output. The 
case of n/2 <t<n will be discussed below. 

The formal security analysis of |CDN01] can be adapted to show that our 
protocol is secure against a static, active adversary corrupting at most t < n 
parties, assuming the intractability of the DDH problem. This follows from the 
fact that we are able to simulate the multiplication protocols of Section [3] in 
a statistically indistinguishable manner, provided that the simulator for these 
protocols is given encryptions of the correct output values. We thus achieve the 
same level of security as |CI)N01| . The important difference is that |GI)N01| 
incorporates a general multiplication gate, for which they need an RSA-like 
cryptosystem such as Paillier’s cryptosystem to get an efficient multiplication 
protocol, while we incorporate a restricted multiplication gate, for which we have 
presented an efficient multiplication protocol using the ElGamal cryptosystem. 

4.1 Private Outputs 

In this section, we propose a new non-interactive protocol for achieving private 
outputs in the context of secure multiparty computation based on homomorphic 
threshold cryptosystems. Previous methods require the receiving parties to per- 
form some blinding step, as part of the decryption protocol. For our method, it 
suffices to know the public keys of the receiving parties. 

We need a different method than |CDN01] to deal with private outputs any- 
way, since their method would require us to decrypt an ElGamal encryption of 
a random message in Z g . Suppose [m] is an encryption of a private output for 
party Pj, that is, output m is intended for party Pj only. Briefly, the method of 
|CDN01] is to let party Pj first blind encryption [m] by multiplying it with a 
random encryption |r] for some r GrZ q . The encryption [m + r] is then jointly 
decrypted, resulting in the value m' = m + r, from which (only) party Pj is 
able to compute m = m! — r. This method critically depends on the ability to 
decrypt arbitrary messages. Using an RSA-like cryptosystem, such as Paillier’s 
cryptosystem, this is no problem. Using ElGamal encryption, however, we can- 
not decrypt [m + r] (see Section [3| • A first way out is to adapt the ElGamal 
decryption step to output g m+r instead of to + r; the receiving party may divide 
this value by g r to obtain g rn from which m may be determined, assuming m is 
from a small set. 

We note however that in general it is undesirable that interaction with the 
receiving parties is required to produce private outputs. Therefore, we present 
a protocol for which no interaction with the receiving party is required. The 
protocol runs as follows. Let (a, b ) £ [m] be an output intended for party Pj 
and let hj = g aj denote Pj ' s public key. Recall from Section [2] that threshold 
decryption requires each party Pj to produce the value a ai along with a proof 
of correctness. We modify this step as follows, by releasing a ai encrypted under 
Pj’s public key and adapting the proof of correctness accordingly: 
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1. Each party Pj outputs an encryption (cj, d t ) = ( g ri ,hPa ai ) with r, Gr Z q 
along with a proof that it knows rj, a* satisfying 

hi = g ai , Ci = g r \ di = h r fa ai . 

2. For decryption, party Pj first uses Lagrange coefficients A, to compute the 
following product for a set of t + 1 valid shares (c, : , d,): 

II (ci,di) Xi = (gZ<** r <,hp Airi aZ< *«**). 

Then Pj decrypts this product using its private key aj to obtain a^* Xi<Xi = 
o“. Party Pj then proceeds to recover g m = b/a a , from which it finds m 
assuming that m belongs to a relatively small, known subset of Z q . 

The protocol requires only a small amount of additional work compared to 
the basic protocol for decrypting public outputs, where each party P % outputs 
a ai along with a proof of correctness (cf. step 1), from which anyone is then able 
to recover Xi0li = a a using t + 1 valid shares (cf. step 2). 

4.2 Fairness 

Recall that t denotes the maximum number of corrupted parties tolerated by the 
circuit evaluation protocol. For t < n/ 2, that is, the case of a dishonest minority, 
the protocol achieves robustness. We now extend the protocol to handle the 
two-party case t = l,n = 2 (which is a special case of a dishonest majority, 
n/2 <t <ri). 

For the two-party case we give up on robustness, since one cannot prevent 
one of the parties from quitting the protocol prematurely. If a party chooses to 
do so, however, it should not gain any advantage from it. If a protocol achieves 
this property, the protocol is said to be fair. 

An important observation for the above circuit evaluation protocol is that 
neither party gains any advantage from quitting the protocol in phase 1 or 
phase 2 of the protocol. In particular, consider the case that party P 2 , say, 
chooses to quit during the threshold decryption step of a conditional gate, for 
which party Pi has already produced its decryption share. In that case, only 
P 2 learns the decrypted value x n , but this value cannot possibly give P 2 an 
advantage, as follows from the simulation in the proof of Theorem Q] 

Therefore, to achieve fairness, we only need to protect the decryption of 
the output values. For this purpose, we will apply a protocol similar to that 
of |BST01j . In |BST01j . however, the protocol steps for achieving fairness are 
intertwined with the original protocol steps, while in our protocol the additional 
steps for achieving fairness are strictly limited to the decryption of the output 
values. 

Let an encryption (a, b ) be given. Recall that (2, 2)-threshold decryption, 
requires party Pj to provide dj = a ai , i = 1,2, along with a proof that this value 
is correct w.r.t. the public key hi = g ai of party Pj. Instead of directly revealing 
this value, we will release it gradually using the following protocol, where k is a 
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security parameter, k < log 2 q, and h G (g) denotes an additional generator for 
which log 9 h is unknown to parties P \ , P- 2 : 

1. For i = 1,2, party Pi chooses ey Sb {0, 1}, ay Gr Z q for j = 0, . . . , k — 1 

subject to the condition that a* = Xy=o «y'2T Party P* then broadcasts 
the values dy = q“«7i 6 «, j = 0, .... A: - I along with a proof that each 
ey G {0,1} and a proof that n^=o ^Tj = where a* = log f; hi, for some 

value e. 

2. Set j = k — 1. Parties Pi,P 2 repeatedly execute the following step. For 
i = 1,2, party Pi broadcasts values ay,ey. If these values verify correctly 
against dy , the value of j is decremented and the step is repeated if j > 0. 

3. Once j = 0 both parties release ew along with a proof of knowledge for a 
witness a^o satisfying dioh~ eio = a ai0 . 

4. Both parties are able to recover the missing value a ai , as follows: 



At each stage of the protocol, either party is at most one bit ahead of the 
other party. If one sets k = 80, for instance, it is clearly infeasible for both parties 
to compute the missing value a ai at step 1, as it requires a search over 2 fc possible 
values for e^-i, . . . , e®, At each later step, the search space is reduced in size 
by a factor of two. 

The protocol does not leak any information on a t beyond what is implied 
by the output values a ai . The protocol can be run in parallel for decrypting 
multiple outputs at the same time, and the protocol can be combined easily 
with our protocol for private outputs presented above. 

The above protocol achieves a basic level of fairness. In |Pin03| a strengthened 
notion of fairness for two-party computation is considered, which also addresses 
the case where one party may be considerably more powerful than the other 
party; the timed commitments used to resolve this problem, however, critically 
depend on the hardness of factoring. (The recent paper |GMY04b] describes a 
way to cover fairness in a universally composable way, for static adversaries. In 
particular, the result of |CDN01] is extended to cover fairness as well, using a 
factoring related assumption to achieve timed commitments.) Apart from this 
difference, the result of |Pin03| is comparable to our result. The difference is 
that |Pin03] is based on Yao’s garbled circuit approach, while our approach is 
based on homomorphic threshold cryptosystems. In both cases, however, the 
changes to make the protocol fair are limited to the output stage, where some 
form of gradual release is used in combination with a method to ensure that 
commitments opened during gradual release indeed contain the correct output 
of the computation. 


5 Relational and Arithmetic Operators 

In this section we apply our set of elementary gates over Z q to obtain efficient 
circuits for basic operations such as integer comparison and integer addition. In 
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most cases, the inputs are required to be given by their binary representations. 
We consider the general case, in which the circuits operate on encrypted inputs, 
producing encrypted outputs, such that they can be used as building blocks in 
constructing circuits for more elaborate functions, either in a two-party setting 
or in a general multiparty setting. 

5.1 sgn(a: - y) 

Below, we present an efficient protocol for comparing two (non-negative) in- 
teger values x and y. The inputs are given as sequences of encrypted bits, 
[x ro _i],...,[a;o] and [y m _i], . . . , [y 0 J, with x = YT=o % ®i 2 % V = Vi 2 * • 

The output of the protocol consists of an encryption [sgn (a; — j/)], where sgn 
denotes the signum function: 

f-l,z<0, 

sgn z = < 0, z = 0, 

[ l,z>0. 

Using that x 2 = x t and y 2 = y t for x z , yi e {0,1}, the general strat- 
egy is now to examine the unique multilinear polynomial p over Z q satisfying 
p(xo, ■ ■ ■ ,x m -i,yo, ■ ■ ■ ,y m -i) = sgn(a; — y) for all x,y, 0 < x,y < 2 m . The 
problem that remains is to find an efficient circuit (or, equivalently, an oblivious 
evaluation order) for the polynomial p. 

As a first step, we consider the evaluation p = s o with 

s m-i = 0 , s^Si + il-sDixt-yJ. 

Clearly, this results in the correct output value. However, we cannot evaluate 
the term s 2 by means of a conditional gate since s* is three-valued 
(si G {—1,0,1}). This is easily resolved by introducing an auxiliary binary 
sequence Vi, with V{ = 1 — sf: 

s m - 1=0, Si-! = Si+Vi(xi-yi), 

n m _i = 1, i - Vi - Vi( Xi - yi) 2 . 

Now, it is easy to draw up a circuit using 3 m — 2 conditional gates (using 
that s m - 1 = 0 and v TO _i = 1 are publicly known values, hence need not be 
encrypted). 

We note that the bits may also be traversed in the opposite direction, starting 
at the least significant bit. This results in the following sequence, with s' m as 
output: 

So = 0, s' +1 = (1 - (Xi - Vi) 2 )s'i +Xi- yi. 

This method only needs 2 m — 2 conditional gates: per iteration, one condi- 
tional gate to compute aqj/j and one to subsequently compute (1 — (xi — j/,;) 2 ).s' 
with 1 — (xi — yi) 2 as dichotomous multiplier. Here we take full advantage of the 
fact that the conditional gate does not put any constraints on the multiplicand: 
whereas a Boolean circuit for sgn(a; — y) requires all intermediate values to be 
binary, our circuit uses non-binary intermediate values, such as the ternary s(’s. 
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5.2 x > y 

The output of x > y consists of one bit only, which is set to 1 if x > y and to 0 
otherwise. Starting at the least significant bit, the output is given by t m , where 

t 0 = 0, t i+ 1 = (1 - {xi - yi) 2 )ti + Xi( 1 - yi). 

This method requires 2m — 1 conditional gates. (For comparison we note that 
the best known circuit using only logical gates requires 5m binary gates, e.g. us- 
ing the circuit for Biggerk(X, Y) of |KQ02] . Similarly, for computing M ax(X. Y) 
given Biggerk(X,Y), 2m additional gates are required in |K()02j . while we can 
compute the bits of z = max{x,y) by setting Z; L = i/j — t m (xi + yi), using only 
m additional conditional gates.) 

We now specialize this solution for x > y to obtain a solution for Yao’s basic 
millionaires problem |Yao82j . In this case, the protocol is run by two parties, pro- 
viding x and y respectively as private inputs. This allows for a much more efficient 
solution, as the conditional gates can all be replaced by the private-multiplier 
gates of Section 13.11 The private-multiplier gates can be even optimized slightly 
by using Pedersen commitments instead of ElGamal encryptions, and using that 
the multipliers are binary. 

The total computational cost of our solution to Yao’s millionaires problem, 
including the cost of the distributed key generation and the decryption of the 
result, is dominated by the cost of about 2m private-multiplier gates (computing 
lyitii and \xi{ti — 2yiti—yi)\ as intermediate values), which require 6 exponenti- 
ations each, hence 12m exponentiations in total (starting at the least significant 
bit). To the best of our knowledge, this is the most efficient solution to date. 
Here, we cover the malicious case (unlike many other papers on the millionaires 
problem, that only deal with the semi-honest case, e.g., |Fis01llNN01llIG03j ). but 
we do not cover fairness. We also note that we do not need an auxiliary trusted 
party, as in |Cac99| . although that paper achieves fairness as well at a relatively 
low cost. Finally, while most other solutions rely on an RSA-like assumption, 
our solution is secure under the standard DDH assumption. This is also true 
for the solution of |KOfl2] , but their solution is much less efficient because their 
circuits are evaluated using the expensive Mix and Match gates of |JJ00] . 

5.3 x = y 

For testing equality of x and y, the following sequence can be used, where the 
output u m = 0 iff x = y: 

uq = 0 , u i+ 1 = (1 - (Xi - yi) 2 )ui + (Xi - yi) 2 . 

The order in which the bits are processed is actually irrelevant. This method 
requires 2m — 1 conditional gates, returning the output bit in encrypted form. 

The socialist millionaires problem, a variant introduced by [JY96] , is to eval- 
uate x = y for a two-party setting, where x,y G Z q are the respective pri- 
vate inputs, and the output may be public. The currently best solution is due 
to |BSTfllj . using only 0(1) exponentiations, hence without using the binary 
representations of x and y. We obtain a solution in a similar vein as follows. The 
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parties broadcast [x] and hi resp., and jointly form [r], where r Gr Z q and 
neither of the parties knows r. Using the private multiplier gate, the parties then 
compute [(x — y)rj, which is jointly decrypted to obtain gU-s/V (rather than 
obtaining (x — y)r). If g( x ~y'> r = 1, then w.v.h.p. x = y, otherwise x /^g. 

5.4 x + y and x * y 

Given [x],[y], one obtains \x + y\ directly using the homomorphic property. 
A nice application of the conditional gate is that [xy\ can also be computed 
efficiently, if we assume that x is given in binary form. 

Given [x m _i], . . . , [xo] and [y], where y £ Z q , one computes [xy] using that 
xy = Xi(y2 l ). This method requires only m conditional gates, whereas a 

standard Boolean circuit would require 0(m 2 ) bit multiplications. 

6 Concluding Remarks 

We envision a practical system supporting ad hoc contacts among a large group 
of peer users. Since efficient DKG protocols for (2, 2)-threshold ElGamal are 
easily achieved, our results show that any pair of users is able to engage in a two- 
party computation for evaluating some dynamically agreed upon function. For 
example, the circuits of the previous section lead to solutions for tasks of practical 
interest, such as profile matching, allowing two users with profiles (length m bit 
vectors) x and y, resp., to evaluate A(x,y) > T, where A(x,y) = YULi x iVi is 
an example similarity measure and T is a threshold. 

Further research is required for a full comparison with some recent approaches 
to secure (two-party) computation. For instance, an interesting approach is pre- 
sented in |GMY04aj . which is based on committed oblivious transfer instead of 
homomorphic threshold encryption. The amount of work per gate is comparable 
to the work for a conditional gate, but the hidden constants for their approach 
are larger than in our case. This is partly due to the fact that their solution 
is designed to be universally composable, but remains true if their solution is 
‘downgraded’ to a protocol for static adversaries; per gate, one party uses 5 bit 
commitments and proves a number of relations for these commitments, followed 
by a (f) oblivious transfer. For a full comparison with |GMY04a] , our solution 
needs to be ‘upgraded’ to a universally composable one, e.g., following the ap- 
proach of |DN03| . This would provide an interesting alternative, as the extension 
of [GMY04a] to the multiparty case requires each pair of parties to rim their ba- 
sic two-party protocol for each multiplication gate, while with our approach the 
parties run a single joint protocol for each conditional gate. 

A well-known alternative to the gate-by-gate approach, is Yao’s garbled cir- 
cuit approach for two-party computation. The Fairplay system is designed to 
evaluate the practical merits of the garbled circuit approach, including some op- 
timizations that will pay off for sufficiently large circuits |MNPS04] , We expect 
a trade-off showing that the garbled circuit approach is best for large circuits 
whereas a gate-by-gate approach is best for small circuits, or rather circuits for 
which the number of inputs is proportional to the total number of gates. 
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Abstract. We study private computations in information-theoretical 
settings on networks that are not 2-connected. Non-2-connected networks 
are “non-private” in the sense that most functions cannot privately be 
computed on them. We relax the notion of privacy by introducing lossy 
private protocols, which generalize private protocols. We measure the 
information each player gains during the computation. Good protocols 
should minimize the amount of information they lose to the players. 
Throughout this work, privacy always means 1-privacy, i.e. players are 
not allowed to share their knowledge. Furthermore, the players are honest 
but curious, thus they never deviate from the given protocol. 

By use of randomness by the protocol the communication strings a 
certain player can observe on a particular input determine a probability 
distribution. We define the loss of a protocol to a player as the logarithm 
of the number of different probability distributions the player can ob- 
serve. For optimal protocols, this is justified by the following result: For 
a particular content of any player’s random tape, the distributions the 
player observes have pairwise fidelity zero. Thus the player can easily 
distinguish the distributions. 

The simplest non-2-connected networks consists of two blocks that 
share one bridge node. We prove that on such networks, communication 
complexity and the loss of a private protocol are closely related: Up to 
constant factors, they are the same. 

Then we study 1-phase protocols, an analogue of 1-round communi- 
cation protocols. In such a protocol each bridge node may communi- 
cate with each block only once. We investigate in which order a bridge 
node should communicate with the blocks to minimize the loss of infor- 
mation. In particular, for symmetric functions it is optimal to sort the 
components by increasing size. Then we design a 1-phase protocol that 
for symmetric functions simultaneously minimizes the loss at all nodes 
where the minimum is taken over all 1-phase protocols. 

Finally, we prove a phase hierarchy. For any k there is a function such 
that every ( k — l)-phase protocol for this function has an information 
loss that is exponentially greater than that of the best fc-phase protocol. 
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1 Introduction 

Consider a set of players, each knowing an individual secret. They want to com- 
pute some function depending on their secrets. But after the computation, no 
player should know anything about the other secrets except for what he is able 
to deduce from his own secret and the function value. This is the aim of pri- 
vate computation (also called secure multi-party computation). To compute the 
function, the players can send messages to each other using secure links. 

An example for such a computation is the “secret voting problem”: The 
members of a committee wish to decide whether the majority votes for yes or 
no. But after the vote nobody should know anything about the opinions of the 
other members, not even about the exact number of yes and no votes, except for 
whether the majority voted for yes or no. 

If no group of at most t players can infer anything about the input bits that 
cannot be inferred from the function value and their own input bits, we speak 
of t-privacy. 

Any Boolean function can privately (in the following we identify privately 
with 1-privately) be computed on any 2-connected network. Unfortunately, there 
are many Boolean functions, even simple ones like parity or disjunction, that 
cannot privately be computed if the underlying network is not 2-connected [S] . 

However, many real-world networks are not 2-connected and private compu- 
tation is not possible. If the players in the network have to compute something 
but do not trust each other, there is a natural interest of the players in privacy. 
What can we do? We relax the notion of privacy: One cannot require that any 
player learns only what he is able to deduce from his own secret and the function 
value. Instead we require that any player learns as little as possible about the 
secrets of the other players (in an information-theoretical sense) while it is still 
possible to compute the function. 

Bridge nodes are important when considering non- 2-connected networks. For 
all non-bridge players we can guarantee that they do not learn anything except 
for what they can deduce from their own bit and the function value. Thus, the 
bridge players are the only players that are able to learn something more. The 
question is now, how much the bridge players need to learn such that the function 
can be computed. The simplest setting is a network of two blocks with one bridge 
node in common. (A block is a maximal 2-connected subnetwork.) This reminds 
one of communication complexity with a man in the middle: Alice (one block) 
and Bob (another block) want to compute a function depending on their in- 
put while preventing Eve (the bridge node) from learning anything about their 
input. Unfortunately, Eve listens to the only communication channel between 
Alice and Bob. In terms of communication complexity, this problem had been 
examined by Modiano and Ephremedis |131I14| and Orlitsky and El Gamal [T7] 
under cryptographic security. In contrast, we deal with information-theoretical 
security, i.e. the computational power of the players is unrestricted. Furthermore, 
we are not interested in minimizing communication but in minimizing the infor- 
mation learned by any player. It turns out that there is a close relation between 
communication and privacy, at least in this special case. 
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1.1 Previous Results 

Private computation was introduced by Yao m- He considered the problem 
under cryptographic assumptions. Private Computation with information-theo- 
retical security has been introduced by Ben-Or et al. 0 and Chaum et al. [B]. 
Kushilevitz et al. PI proved that the class of Boolean functions that have a 
circuit of linear size is exactly the class of functions that can privately be com- 
puted using only a constant number of random bits. Kushilevitz m and Chor 
et al. [7] considered private computations of integer-valued functions. They ex- 
amined which functions can privately be computed by two players. Franklin 
and Yung [5] used directed hypergraphs for communication and described those 
networks on which every Boolean function can privately be computed. 

While all Boolean functions can privately be computed on any undirected 2- 
connected network, Blaser et al. [5] completely characterized the class of Boolean 
functions that can still privately be computed, if the underlying network is con- 
nected but not 2-connected. In particular, no non-degenerate function can pri- 
vately be computed if the network consists of three or more blocks. On networks 
with two blocks, only a small class of functions can privately be computed. 

Chaum et al. [6] proved that any Boolean function can privately be computed, 
if at most one third of the participating players are dishonest, i.e. they are 
cheating. We consider the setting that all players are honest, i.e. they do not 
cheat actively but try to acquire knowledge about the input bits of the other 
players only by observing their communication. For this model, Ben-Or et al. [3] 
proved that any n-ary Boolean function can be computed -private. Chor 

and Kushilevitz [8] showed that if a function can be computed at least ^-private, 
then it can be computed n-private as well. 

The idea of relaxing the privacy constraints has been studied to some extend 
in a cryptographic setting. Yao [30] examined the problem where it is allowed 
that the probability distributions of the messages seen by the players may differ 
slightly for different inputs, such that in practice the player should not be able 
to learn anything. Leakage of information in the information-theoretical sense 
has been considered only for two parties yet. Bar- Yehuda et al. [5] studied the 
minimum amount of information about the input that must be revealed for 
computing a given function in this setting. 

1.2 Our Results 

We study the leakage of information for multi-party protocols, where each player 
knows only a single bit of the input. Our first contribution is the definition of lossy 
private protocols, which is a generalization of private protocols in an information- 
theoretical sense ( Section 12.211 . Here and in the following, private always means 
1-private. Throughout this work, we restrict ourselves to non- 2-connected (in the 
sense of non- 2- vertex-connected) networks that are still 2-edge-connected. Every 
block in such a network has size at least three and private computation within 
such a block is possible. We measure the information any particular player gains 
during the execution of the protocol in an information-theoretical sense. This 
is the loss of the protocol to the player. The players are assumed to be honest 
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but curios. This means that they always follow the protocol but try to derive as 
much information as possible. 

We divide lossy protocols into phases. Within a phase, a bridge player may 
exchange messages only once with each block he belongs to. Phases correspond 
to rounds in communication complexity but they are locally defined for each 
bridge player. 

In the definition of lossy protocols, the loss of a protocol to a player is merely 
the logarithm of the number of different probability distributions on the com- 
munication strings a player can observe. We justify this definition in Section [3J 
For a protocol with minimum loss to a player P and any particular content of 
P’s random tape, the support of any two probability distributions is disjoint. 
Thus, in order to gain information, P can distinguish the distributions from the 
actual communication he observes and does not need to sample. 

The simplest non-2-connected network consists of two blocks that share one 
bridge node. In Section 0] we show that the communication complexity of a 
function / and the loss of a private protocol for / are intimately connected: Up 
to constant factors, both quantities are equal. 

Then we study 1-phase protocols. We start with networks that consist of 
d blocks that all share the same bridge player P. In a 1-phase protocol, P 
can communicate only once with each block he belongs to. However, the loss 
of the protocol may depend on the order in which P communicates with the 
blocks. In Section [5] we show that the order in which P should communicate 
with the blocks to minimize the loss equals the order in which d parties should 
be ordered on a directed line when they want to compute the function with 
minimum communication complexity. Particularly for symmetric functions, it 
is optimal to sort the components by increasing size. Then we design a 1-phase 
protocol (Theorem 0), which has the remarkable feature, that it achieves minimal 
loss at any node for symmetric functions. Hence, it simultaneously minimizes the 
loss for all nodes where the minimum is taken over all 1-phase protocols. 

In Section [SJ we prove a phase hierarchy. For any k there is a function for 
which every (k — l)-phase protocol has an exponentially greater information loss 
than that of the best fc-phase protocol. 


1.3 Comparison of Our Results with Previous Work 

One of the important features of the two-party case is that at the beginning each 
party has knowledge about one half of the input. In the multi-party case each 
player knows only a single bit of the input. 

Kushilevitz m examined which integer-valued functions can privately be 
computed by two players. He showed that requiring privacy can result in expo- 
nentially larger communication costs and that randomization does not help in 
this model. Chor et al. [7] considered multi-party computations of functions over 
the integers. They showed that the possibility of privately computing a function 
is closely related to its communication complexity, and they characterized the 
class of privately computable Boolean functions on countable domains. Neither 
Kushilevitz m nor Chor et al. [7] examined the problem how functions that 
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cannot privately be computed can still be computed while maintaining as much 
privacy as possible. 

Leakage of information in the information-theoretical sense has been consid- 
ered only for two parties, each holding one n-bit input of a two- variable function. 
Bar-Yehuda et al. [2] investigated this for functions that are not privately com- 
putable. They defined measures for the minimum amount of information about 
the individual inputs that must be learned during the computation and proved 
tight bounds on these costs for several functions. Finally, they showed that sac- 
rificing some privacy can reduce the number of messages required during the 
computation and proved that at the costs of revealing k extra bits of informa- 
tion any function can be computed using 0(k ■ 2 ( 2 ”+ 1 )/(fc+ 1 )) messages. 

The counterpart of the two-party scenario in the distributed setting that we 
consider is a network that consists of two complete networks that share one node 
connecting them. Simulating any two-party protocol on such a network allows the 
common player to gain information depending on the deterministic communica- 
tion complexity of the function that should be evaluated. Hence and in contrast 
to the two-party case, increasing the number of bits exchanged does not help 
to reduce the knowledge learned by the player that is part of either block. An 
important difference between the two-party scenario, where two parties share 
the complete input, and a network consisting of two 2-connected components 
connected via a common player (the bridge player) is that in the latter we have 
somewhat like a “man in the middle” (the bridge player) who can learn more 
than any other player, since he can observe the whole communication. 

2 Preliminaries 

For i, j G N, let [i] := {1, . . . , i} and [i..j] := {i , . . . , j}. Let x = X 1 X 2 ■ ■ ■ x n G 
{0, 1}” be a string of length n. We often use the string operation Xi«_ 0 defined 
for any i G [n] and a G {0, 1} by x\ . . .Xi-\axi + 1 . . . x n . For a function / : 
{0,1}” — > {0,1}, an index i G [n], and a G {0,1}, fi<- a : {0,1}" -1 — > {0,1} 
denotes the function obtained from / by specialising the position i to the value 
given by a, i.e. for all x = x\x% ■ ■ ■ x n _i G {0, l}" -1 , 

f i ^ a (x) = f(x 1 ,...,x i - 1 ,a,x i ,...x n - 1 ). 

An undirected graph G = (V, E) is called 2-connected, if the graph obtained 
from G by deleting an arbitrary node is still connected. For a set U C V, let 
G\u := (U,E\u) be the graph induced by U. A subgraph G\u is called a block, 
if G\u is 2-connected and no proper supergraph G\u is 2-connected. A block of 
size two is called an isthmus. A graph is called 2-edge-connected if after removal 
of one edge, the graph is still connected. A graph is 2-edge-connected if it is 
connected and has no isthmi. A node belonging to more than one block is called 
a bridge node. The other nodes are called internal nodes. The blocks of a graph 
are arranged in a tree structure. For more details on graphs, see e.g. Berge [4]. 

A Boolean function is symmetric, if the function value depends only on the 
number of Is in the input. See Wegener [TO] for a survey on Boolean functions. 
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2.1 Private Computations 

We consider the computation of Boolean functions / : {0, 1}" — > {0, 1} on a 
network of n players. In the beginning, each player knows a single bit of the 
input x. Each player has a random tape. The players can send messages to 
other players using secure links where the link topology is an undirected graph 
G = (V. E). When the computation stops, all players should know the value 
f(x). The goal is to compute f(x ) such that no player learns anything about the 
other input bits in an information-theoretical sense except for the information 
he can deduce from his own bit and the result. Such a protocol is called private. 

Definition 1. Let Ci be a random variable of the communication string seen by 
player Pi . A protocol A for computing a function f is private with respect to 
player Pj if for any pair of input vectors x and y with f(x) = f{y) and Xi = yi, 
for every c, and for every random string Ri provided to Pi, 


Pr [Ci = c\Ri,x] = Pr [C t = c\Ri,y) , 


where the probability is taken over the random strings of all other players. A 
protocol A is private if it is private with respect to all players. 

In the following, we use a strengthened definition of privacy: We allow only 
one player, say Pi, to know the result. The protocol has to be private with 
respect to Pi according to Definition Q] Furthermore, for all players Pj / =Pj, for 
all inputs x, y with Xj = yj, and for all random strings R.j we require Pr[Cj = 
c\Rj,x] = Pr [Cj = c\Rj,y\. Thus, all other players do not learn anything. This 
definition does not restrict the class of functions computable by private protocols 
according to Definition [lj To achieve this additional restriction, Pi generates a 
random bit r. Then we use a private protocol for computing r © f(x). 

2.2 Information Source 

The definition of privacy basically states the following: The probability that a 
player Pj sees a specific communication string during the computation does not 
depend on the input of the other players. Thus, Pj cannot infer anything about 
the other inputs from the communication he observes. 

If private computation is not possible since the graph is not 2-connected, it is 
natural to weaken the concept of privacy in the following way: We measure the 
information player Pj can infer from seeing a particular communication string. 
This leads to the concept of lossy private protocols. The less information any 
player can infer, the better the protocol is. 

In the following, Ci, c%, C3, . . . denotes a fixed enumeration of all communica- 
tion strings seen by any player during the execution of A. 

Definition 2. Let Ci be a random variable of the communication string seen by 
player Pi while executing A. Then for a. b G {0, 1} and for every random string 
Ri provided to Pi, define the information source of Pi on a, b, and R t as 


S^(i, a, b, Rf) := {(/Xx(ci),/x x (c 2 ), . . .) | x € {0, 1}” A Xi = a A f(x) = b} 


Privacy in Non-private Environments 143 


where /x x (cfc) := Pr[Cj = Ck\Ri,x] and the probability is taken over the random 
strings of all other players. 

Basically S^{i,a,b, Pj) is the set of all different probability distributions on 
the communication strings observed by Pi when the input x of the players varies 
over all possible bit strings with a ;* = a and /( x) = b. The loss of a protocol A 
on a, b with respect to player P, is 

i = maxlog a , b , Pj)| . 

Thus the protocol looses l bits of information to Pj. We call such a protocol 
t-lossy on a, b with respect to Pi. 

If a uniform distribution of the input bits is assumed, then the self-informa- 
tion of an assignment to the players Pi, , Pj_i, Pi+i , . . . , P n is n — 1 |18| . In 
this case the maximum number of bits of information that can be extracted by 
Pi is n — 1. If A is 0-lossy for all a. b G {0, 1} with respect to Pj, then we say that 
A is lossless with respect to P ?: . A is lossless to Pj iff A is private to Pj. Thus 
the notion of lossy private protocols generalizes the notion of private protocols. 

Definition 3. A protocol A computing a function f in a network G is l^-lossy. 
with £4 : [n] x {0, l} 2 — > Rq , if (,^{i,a,b) = max^Tog |<Sa(*, a, b, Pj)|. Let f be 
an n-ary Boolean function. Then for every network G = ( V,E ) with \V\ = n, 
define £q : [n] x {0, l} 2 — * Rq by 

Fc{i, a, b) := min{T_4(i, a,b ) I A is an t^-lossy protocol for f in G} . 

A 

The loss of a protocol A is bounded by A £ N, if £^(i,a,b) < A for all i, 
a, and b. lo(i, cl, b ) is obtained by locally minimizing the loss to each player Pi 
over all protocols. It is a priori not clear whether there is one protocol with 
ia(i, cl, b ) = £a(F. cl, b) for all i, a, b. We show that this is the case for symmetric 
functions and 1-phase protocols (as defined in Section 12.311 . 

We also use the size of the information source, defined by s^(i, a. b, R.,) = 
|5^(i, a, b, Rf) \ and s^{i, a, b) = max^ s^(i, a, b, Rf) for a given protocol A. By 
definition, £^(i,a,b) = log s^{i,a,b). If the underlying protocol is clear from 
the context, we omit the subscript A. Let / be an n-ary Boolean function. For 
a network G = (V,E) with \V\ = n, we define so(i,a,b ) := min^ s^(i, a, b). 
If a player Pj is an internal node of the network, then it is possible to design 
protocols that are lossless with respect to Pj (see Section [3J. Players Pj that are 
bridge nodes are in general able to infer some information about the input. 

2.3 Phases in a Protocol 

We say that a player P q who corresponds to a bridge node makes an alternation 
if he finishes the communication with one block and starts to communicate with 
another block. During such an alternation, information can flow from one block 
to another. We partition a communication sequence c = did^ ■ ■ ■ of P q into a 
minimal number of disjoint subsequences (di, . . . , djj, (dj 1+ i, . . . , dj 2 ), . . . such 
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that each subsequence is alternation-free (i.e. P q makes no alternation during the 
corresponding interval). To make such a partition unique assume that each subse- 
quence (maybe except for the first one) starts with a non-empty message. We call 
these subsequences block sequences of c and define blockj(c) := (d^_ 1+ 1, . . . , d^) 
with *o = 0. Next we partition the work of P q into phases as follows. P q starts at 
the beginning of the first phase and it initiates a new phase when, after an alter- 
nation, it starts to communicate again with a block it already has communicated 
with previously in the phase. 

A protocol A is a k-phase protocol for a bridge node P q if for every input 
string and contents of all random tapes, P q works in at most k phases. A is 
called a k-phase protocol if it is a fc-phase protocol for every bridge node. 

The start and end round of each phase does not need to be the same for each 
player. Of particular interest are 1-phase protocols. In such a protocol, each bridge 
player may only communicate once with each block he belongs to. Such protocols 
seem to be natural, since they have a local structure. Once the computation is 
finished in one block, the protocol will never communicate with this block again. 

For fc-phase protocols we define £%,(i,a,b) and Sg(i,a, b) in a similar way as 
fU and sc; in the general case, but we minimize over all /c-plia.se protocols. 

During each phase a player communicates with at least two blocks. The order 
in which the player communicates within a phase can matter. The communica- 
tion order a q of a bridge node P q specifies the order in which P q communicates 
with the blocks during the whole computation. Formally, a q is a finite sequence 
of (the indices of) blocks P q belongs to and the length of a q is the total number 
of alternations made by P q plus one. We say that a protocol is o q -ordered for P q 
if for all inputs and all contents of the random tapes, the communication order of 
P q is consistent with <j q . Let Pqi > • • • i P<ik with qi < q 2 < . . . < qu be an enumer- 
ation of all bridge players of a network G and a = {<j qi , ,a gk ) be a sequence of 
communication orders. We call a protocol o-ordered if it is a qj -ordered for every 
P q .. Finally, define Sc(i,a,b,a) := min {54(2, a. b) \ A is cr-ordered for / on G}. 

2.4 Communication Protocols 

For comparing the communication complexity with the loss of private protocols, 
we need the following definitions. Let / : {0, l} mi x {0, l}™ 2 — ► {0, 1} be a 
Boolean function and B be a two-party communication protocol for computing 
/. Let 3/i £ {0, l} mi and 3/2 € {0, l} m2 be two strings as input for the two parties. 
Then CC^iyi, j/2) is the total number of bits exchanged by the two parties when 
executing B. 

GG{B) is the maximum number of bits exchanged by executing B on any 
input. Analogously, CS(Z3) is the number of different communication strings that 
occur. (We simply concatenate the messages sent.) Finally, we define CC(/) = 
mine for f CC (B) and CS(/) = min B for f CS (B). 

CC (/) and CS (/) are the communication complexity and communication 
size, respectively, of the function /. CC (B) and CS(£>) are the communication 
complexity and communication size for a certain protocol B. The communication 
size is closely related to the number of leaves in a protocol tree, usually denoted 
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by C P (B). In the definition of CS, we do not care about who has sent any bit, 
since we concatenate all messages. In a protocol tree however, each edge is labeled 
by the bit sent and by its sender. The bits on a path from the root to a leaf form 
a communication string. Usually, the messages sent in a communication protocol 
are assumed to be prefix-free. In this case, we can reconstruct the sender of any 
bit from the communication string. If this is not the case, then we can make a 
particular communication protocol prefix-free by replacing the messages sent in 
each round by prefix-free code words. The complexity is at most doubled. 

We also consider multi-party communication with a referee. Let / : {0, l} 7 " 1 X 
{0, 1} TO2 x ... x {0, l} mfe — > {0, 1} be a function. Let Ai,...,Ak be k parties 
and R be a referee, all with unlimited computational power. For computing / 
on input . . . , Xk, the referee cooperates with A\,...,Ak as follows: 

— Initially, x\ .,Xk are distributed among A \, . . . , Ak, i.e. knows Xi. The 
referee R does not have any knowledge about the inputs. 

— In successive rounds, R exchanges messages with A\,...,A k according to a 
communication protocol. In each round R can communicate (i.e. receive or 
send a message) only with a single party. 

— After finishing the communications, R eventually computes the result of /. 

Let B be a communication protocol for computing /. Denote by c§(xi , . . . , x k ) 
the whole communication string of R after protocol B has been finished. More 
precisely, Cg (x \, . . . , x k ) is a concatenation of messages sent (to or from R) on 
input xi , . . . , x k with additional stamps describing the sender and the receiver 
of each message. For b £ {0, 1} let 

C5g(6) = {cf(xi, . . . , x k ) | Vi 6 [fe] : x t £ {0, l} m< and f(x i, . . . , x k) = b} , 

CS r (B ) = CS§ (0) U CSg(l) , 

CSg(6) =]CSg(6)|, CS*(£) = ]C<S fl 0B)|, 

CS R (f, b) = ming for f CS §(b) , and CS R (f) = ming for f CS R (B) . 

3 The Suitability of the Model 

We observe that it suffices to consider bridge players when talking about the loss 
of a protocol. More precisely, any protocol can be modified such that the loss to 
all internal players is zero, while the loss to any bridge player does not increase. 

All Boolean functions can be computed by using only three players [3]. Thus, 
it is possible to compute functions privately within any block, since the networks 
we consider are isthmus-free. This holds even if some of the players know a subset 
of the input bits and the result consists of a binary string. 

Finally, in optimal protocols, the probability distributions observed by any 
player have pairwise fidelity 0. Thus, any player can easily distinguish the dif- 
ferent probability distributions he observes. 

We consider arbitrary 1-connected networks. Let / be a Boolean function 
and A be a protocol for computing / on a 1-connected network G. Let P q be a 
bridge player of G, a,b £ {0, 1}, and R q be the random string provided to P q . 
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We define X := {x £ {0, 1}" | x q = a A f(x ) = 6} and, for any communication 
string c, 'ip(c) := {x G X \ p x (c) > 0}, where p x (c) = Pr[O g = c\R q , a;]. For every 
communication string c that can be observed by P q on some input x G X, P q 
can deduce that x e V ; ( c )- If s^(q,a,b) = sc(q,a,b) = X, then we have either 
ip(c) = X or i/j(c) = 0. Thus P q does not learn anything in this case. 

Theorem 1. If sc{q,a,b) > 1, then for any protocol A and every communica- 
tion string c that can be observed by P q on x G X, ip(c) is a non-trivial subset 
of X, i.e. 0 /=^>(c) C X, and there exist at least sc(q,a,b ) different such sets. 

Hence, from seeing c on x £ X, P q always gains some information and there 
are at least sc(q, a. b) different pieces of information that can be extracted by 
P q on inputs from X. To prove this, we show that for each distribution we can 
find one representative string that can be used in the communication protocol. 

The next result says that saiq. a, b ) is a tight lower bound on the number of 
pieces of information: the lower bound is achieved when performing an optimal 
protocol on G. Let p and pi be two probability distributions over the same set 
of elementary events. The fidelity is a measure for the similarity of p and p' (see 
e.g. Nielsen and Chuang [T5] l and is defined by F(p, p!) = V l- l ( c ) ' 

Theorem 2. If A is an optimal protocol for P q on a and b, i.e. s^{q,a,b) = 
sa(q, a, b), then for all random strings R q and all probability distributions p /=p' 
in S^(q, a, b, R q ) we have F(p, p') = 0. 

4 Communication Complexity and Private Computation 

In this section, we investigate the relations between deterministic communication 
complexity and the minimum size of an information source in a network with 
one bridge node. To distinguish protocols in terms of communication complexity 
and protocols in terms of private computation, we will call the former commu- 
nication protocols. From the relation between C p and CC (see e.g. Kushilevitz 
and Nisan [Til-Sec. 2.2]), we get |log(CS(/)) < CC (/) < 3-log(CS(/)). Making 
a communication protocol prefix-free yields the extra factor | . 

Now we investigate the relations between communication size and the size of 
an information source on graphs that consist of two blocks sharing one bridge 
node P q . In the model of private computation the input bits are distributed 
among n players whereas the input bits in a communication protocol are dis- 
tributed among the two parties. Alice and Bob correspond to the first and second 
block, respectively, while both know the bridge player’s bit. 

Theorem 3. If a function f has communication complexity c then there exists 
a protocol for computing f with loss bounded by 2c. On the other hand, if f 
can be computed by a protocol with loss bounded by X, then the communication 
complexity of f is bounded by 6A + 0(1). 

We can generalize the results obtained for the relation two-party commu- 
nication and private computation to obtain similar results for the relation of 
multi-party communication with a referee and private computation as follows: 
For o, b G {0, 1} we have sa(q, a, b) = CS R (f q ^ a , b). 
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5 1-Phase Protocols 

We start our study of 1-phase protocols with considering networks that consist 
of one bridge player who is incident with d blocks. For the case that the order 
in which the bridge player communicates with the blocks is fixed for all inputs, 
we show a relationship between the size of the information source of 1-phase 
protocols and communication size of multi-party 1-way protocols. Furthermore, 
we prove that for every symmetric Boolean function 1-phase protocols can mini- 
mize the loss of information when the bridge player sorts the blocks by increasing 
size. Then we present a simple 1-phase protocol on arbitrarily connected net- 
works that is optimal for every symmetric function. 

5.1 Orderings 

A natural extension of the two-party scenario for 1-way communication is a 
scenario in which the parties use a directed chain for communication: d parties 
A\, . . . , Ad are connected by a directed chain, i.e. A* can only send messages 
to A i+ i. For a communication protocol B on G and i G [d] let S\AB) be the 
number of possible communication sequences on the subnetwork of Ai , . . . , Aj. 
Each communication protocol B can be modified without increasing S'f^(B) in 
the following way: Every party A, first sends the messages it has received from 
A,_ i to A i+ i followed by the messages it has to send according to B. In the 
following we restrict ourselves to communication protocols of this form. 

If the network G consists of d blocks B, with i € [d] and one bridge player P q 
we consider a chain of d parties A j , . . . , A,]. For a cr-ordered 1-phase protocol A, 
we assume that the enumeration of the blocks reflects the ordering a. We have 
to determine the input bits of the parties in the chain according to the input bits 
of the players in the protocol. In the following we will assume that Aj knows the 
input bits of the players in Bj. Thus, each party Aj has to know the input bit 
x q of the bridge player P q . Therefore, we will investigate the restricted function 
f q <—a whenever we analyse the communication size of a communication protocol. 

For a (7-ordered protocol A define <S^(g, o, b, R q ) = {fi x \ x q = a A f(x) = b}, 
where fi x {cjf) denotes the sum of the probabilities Pr[C' 9 = c | R q ,x] over all c 
with c fc = blocki(c) . . .blockj(c) and ci,C 2 ,C 3 , . . . is a fixed enumeration of all 
strings describing the communication of P q in the first i block sequences. 

Lemma 1. Let A be a cr-ordered 1-phase protocol for computing f on a network 
as described above. Then for every a e {0,1} and every content R q of P q ’s 
random tape there exists a 1-way communication protocol B for computing f q ^ a 
such that for all i e [d— 1]. we have 

srw < i4 ] («. «> o, R q ) u s® ( 9 - m, a®) i • 

Let us now focus on the structure of the possible communication sequences of 
an optimal communication protocol on a chain. In such a protocol, the message 
sent from Aj to Aj + i has to specify the subfunction obtained by specifying the 
input bits of the first i blocks according to their input. Hence, the number of 
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possible communication sequences on the network A\,. . . ,A^ is at least the 
number of different sequences of subfunctions that can be obtained in this way. 

The knowledge about these sequences must also be provided to the bridge 
player. Hence, for every fixed R q and b £ {0, 1} the number of distributions in 
[q, a , b, R q ) is at least the number of different sequences fi >x , . . . , fd-i,x for 
inputs x with x q = a and f(x) = b. This implies the following lemma. 

Lemma 2. For a £ {0, 1} ; let B be a communication protocol for computing 
f q <— a on a chain network. Then there exists a a -ordered 1-phase protocol A for 
f such that for all i £ [d — 1] and every content R q of P q ’s random tape, we have 

S'r(B) = [s| 0) 0, R q ) U 4 1 (q, a,l,R q )\. 

Furthermore, for any b £ {0, 1}: If we restrict the inputs to x £ {0, l}” -1 with 
f q ^ a (x) = b, the number of possible communication sequences on the subnetwork 
Ai,..., A i+ 1 is 1^1 (q, a,b,R q )\. 

We can show that there exist functions, for which no ordered 1-phase protocol 
minimizes the size of the bridge players’ information source. Thus, we generalize 
the class of ordering that we consider to achieve such a property. 

We call a protocol A quasi-ordered if for every a, b £ {0, 1}, for every content 
R q for Pq’s random tape, and for every distribution p £ S^iq, a, b, R q ) there 
exists a 1-phase ordering o such that every communication string c with p(c) > 0 
the string c is cr-ordered. Note that this ordering is not necessarily the same for 
all inputs. However, given any input, the ordering is fixed. 

We can prove that among all 1-phase protocols for a given function, there 
always exists a quasi-ordered protocol that minimizes the loss to P q . 

5.2 Orderings for Symmetric Functions 

For symmetric Boolean functions, we can show even more. Arpe et al. [T] have 
proved the following for symmetric Boolean functions with a fixed partition of 
the input bits: for all i, S'f\B) is minimal, if the number of bits known by the 
parties in the chain corresponds to the position of the party, i.e. the first party 
knows the smallest number of input bits, the second party knows the second 
smallest number, and so on. This observation also holds, if we count the number 
of communication sequences in a chain network for inputs x with f(x) = 1 and 
the number of communication sequences in a chain network for inputs x with 
/( x) = 0. Together with Lemma[2j we obtain the following: Let G be a connected 
network with one bridge player P q and d blocks. Let a be a one phase ordering 
that enumerates the blocks of G according to their size. Then for every ordered 
1-phase protocol A ’ there exists a cr-ordered 1-phase protocol A such that for 
all a, b £ {0,1}, for all i < d — 1, and every content R q of P q random tape 
\sW(q,a,b,R q )\ < \S [ $(q,a,b,R q )\. 

This result can be generalized to networks with more than one bridge player. 
Let Gi , . . . , Gk be the connected subgraphs obtained by deleting the bridge 
player P q with 6} < |G,;+i|. We say that P q works in increasing order, if 
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it starts communicating with G\, then with G 2 and so on. We call a 1-phase 
protocol A increasing- ordered, if every bridge player works in increasing order. 

For a graph G let Q = (G-i = (Vi, Ef), . . . ,G h = (V h , E h )} be the set of blocks 
and Q = {q \ ..... <jk} be the set of bridge nodes of G. Every graph G induces a 
tree Tq = ( Vq,Eq ) defined as follows: Vq = Vq U Vg with Vq = {u \ , . . . , Uk} 
and Vg = {v 1 , . . . , v h } and E g = {{u it vj} \ qi § Vj}. 

For every 1-phase communication order o = (a qi , . . . , a qk ) and every bridge 
node qi the order a qi defines an ordering of the nodes Vj £ Vg adjacent to the 


tree- node u, . Let G a 


(!)’• 


^<r qi (ki) 


denote the ordering of blocks adjacent to qi 


with respect to o qi and root CT (uj) := v^.^.y If a is an increasing communication 
order, then there exists a single tree-node vj £ Vg, such that Vj = root CT (uj) for 
all Ui £ Vq adjacent to Vj . Let us call this node the root of Tq. For a tree-node 
w £ Vq let T g [u>] denote the subtree of Tq rooted by w and let V[w] denote the 
nodes of G located in the blocks Gj with Vj £ Tq[w], 

For computing a symmetric function / we use the following protocol. Let 
a be an increasing communication order. Then for an input x every bridge 
player q x computes a sequence of strings y\. ... . yi z ,-\ as follows: Let Xj = 
Ueeh] ^[ w ff 9i (e)] an d Vj = \Xj\. Then y 3 £ {0,1}^ such that for all j < h - 1 
the function obtained from / by specialising the positions in Xj to y 3 is equal 
to the function obtained from / by specialising the positions to Xx 3 , where 
xi for I C [n] denotes the input bits with indices in I. Finally, a node of the 
block that corresponds to the root of Tq computes the result f(x). This can 
be implemented such that no player gains any additional information except for 
3/i> • • • > Uki-i learned by the bridge nodes q t . 


Theorem 4. Let G be a 2-edge-connected network and f be a symmetric Bool- 
ean function. Then for every 1-phase protocol A! computing f on G there exists 
an increasing- ordered 1-phase protocol A for f on G such that for every player 
Pi and for all a,b £ {0, 1}, we have s^(i, a, b) < s^(i, a, b). 


Thus, the protocol presented in this section is optimal for 1-phase computa- 
tions of symmetric functions with respect to the size of the information source. 


6 A Phase Hierarchy 

In this section we show that there are functions for which the size of the infor- 
mation source of some player for a (k — l)-phase protocol is exponentially larger 
than for a fc-phase protocol. The natural candidate for proving such results is 
the pointer jumping function p 3 : Our network G has two blocks A and B, one 
of size nlogn and the other of size nlogn + 1, sharing one bridge player P,. 
For simplicity we assume that A and B are complete subgraphs. The input bits 
represent two lists of n pointers, each of length log n bits. The input bit of Pi 
belongs to the list of the smaller component. Starting with some predetermined 
pointer of A, the task is to follow these pointers, find the jth pointer and output 
the parity of the bits of the jth pointer. Define CS J and CC- 7 in the same manner 
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as CS and CC, but by minimizing over j-round communication protocols instead 
of arbitrary communication protocols. 

Theorem 5. For any protocol A for computing pzk-i, we have s^ _1 (i, a. b) = 
2 n(n/(fciogfc)) f or all a b _ Forp 2k -i, s%(i,a,b) = for all a,b. 

The lower bound follows from work by Nisan and Wigderson m- 

7 Conclusions and Open Problems 

We have considered distributed protocols in “non-private” environments: net- 
works that are connected but not 2-connected. Since private computation of 
arbitrary Boolean functions is impossible on such networks, we have introduced 
a measure for the information that can be inferred by any player and discussed 
some general properties of protocols with respect to this measure. A natural 
question is finding optimal protocols for some concrete functions. 

For threshold (f no ( x U ■ ■ ■ ■ x n) = 1 iff Y^i = l x < — n o) and counting modulo p 
{ g p {x \ , . . . , x n ) = 1 iff Xi = 0 (mod p)), the information loss to any player 
does not depend on the ordering in which a 1-phase protocol computes any of 
these functions, if each block has size at least no and p, respectively. If we have 
blocks of less than p — 1 nodes, there can be a slight difference in the size of P g ’s 
information source depending on the order. 

In general, the size of the information source while communicating in one 
order can be exponentially larger than the size obtained by communication in 
another order. This holds even in case of symmetric functions. 

For 1-phase protocols for symmetric Boolean functions, we have been able to 
minimize the number of bits a player learns for all players simultaneously. An 
obvious question concerns minimizing the loss of more than one bridge player 
simultaneously for general functions. For 1-phase protocols, the answer is neg- 
ative: There are functions, for which no protocol exists that minimizes the loss 
to all players simultaneously. 

It is open whether there exist functions and networks that do not allow to 
minimize the loss to each bridge player simultaneously. For such functions, we 
have to generalize our measure. Two simple examples one might want to examine 
is the stun of the loss to each player and the maximum loss to any player. 
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Abstract. In this paper, we present efficient asynchronous protocols that allow to 
build proactive cryptosystems secure against a mobile fail-stop adversary. Such 
systems distribute the power of a public -key cryptosystem among a set of servers, 
so that the security and functionality of the overall system is preserved against an 
adversary that crashes and/or eavesdrops every server repeatedly and transiently, 
but no more than a certain fraction of the servers at a given time. The building 
blocks of proactive cryptosystems — to which we present novel solutions — are 
protocols for joint random secret sharing and for proactive secret sharing. 

The first protocol provides every server with a share of a random value unpre- 
dictable by the adversary, and the second allows to change the shared represen- 
tation of a secret value. Synchronous protocols for these tasks are well-known, 
but the standard method for adapting them to the asynchronous model requires 
an asynchronous agreement sub-protocol. Our solutions are more efficient as they 
go without such an agreement sub-protocol. Moreover, they are the first solutions 
for such protocols having a bounded worst-case complexity, as opposed to only a 
bounded average-case complexity. 


1 Introduction 

Threshold cryptography addresses the task of distributing a cryptosystem among n 
servers such that the security and functionality of this distributed system is guaran- 
teed even if an adversary corrupts up to t servers |2]] (see m for a survey). Threshold 
cryptosystems are realized by sharing the key of the underlying cryptosystem among 
all servers using a (t + l)-out-n sharing scheme (4), and by accomplishing the cryp- 
tographic task through a distributed protocol. If this task involves the choice of secret 
random values, then the distribution of the task involves so-called joint random secret 
sharing (JRSS) ED , which allow the servers to jointly generate a (t + l)-out-n sharing 
of a random value unpredictable by the adversary. 

Proactive cryptosystems use threshold cryptosystems as the basis, but drastically 
reduce the assumption concerning failures (5) (see □ for a survey). They operate in a 
sequence of time periods called phases and tolerate a mobile adversary, which corrupts 
the servers transiently and repeatedly, and is only restricted to corrupt at most t servers 
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during every phase. Technically, proactive cryptosystems are threshold cryptosystems 
that change the representation of the shared secret key from one phase to another using 
proactive secret sharing (PSS) ©, so that the representations are independent; the old 
representation has to be erased. 

The key to efficient proactivization of many public key cryptosystems for signing and 
encryption lies in efficient solutions for JRSS and for PSS. In the synchronous network 
model with broadcast channels, such solutions exist 00. Although such synchrony 
assumptions are justified in principle by the existence of clock synchronization and 
broadcast protocols, this approach may lead to rather expensive solutions in practice, for 
example when deployed in wide-area distributed systems with only loosely synchronized 
clocks. Furthermore, such systems are vulnerable to timing attacks. 

These issues can be eliminated by considering an asynchronous network in the first 
place. However, the standard approach to building asynchronous protocols for JRSS and 
PSS requires an asynchronous agreement sub-protocol, which substantially contributes 
to the overall complexity of such solutions; see for example fa- 

contributions. In this paper, we provide the first solutions for asynchronous JRSS 
and for asynchronous PSS, which do not rely on an agreement sub-protocol. Avoiding 
agreement results in two main advantages. On one hand, we are able to bound the 
worst-case complexity of our protocols. For previous protocols, one could only bound 
their average case complexity; such protocols therefore could (at least theoretically) run 
forever. On the other hand, our protocols have a worst-case latency of only six rounds, 
whereas the best known previous solution of Cachin et al. m has an expected latency of 
17 rounds (this comparison takes into account that @ can be optimized in our model). 

Our protocols tolerate a fail-stop adversary who may adaptively and repeatedly eaves- 
drop and crash up to t servers in every two subsequent phases, where t <n/ 3. We stress 
that assuming a fail-stop adversary (as opposed to a fully Byzantine adversary) does not 
make the problem of avoiding agreement trivial: the main reason why the standard solu- 
tions for asynchronous JRSS and PSS require agreement is the fact that a crashed server 
cannot be distinguished from a slow server, and this problem also occurs for a fail-stop 
adversary. Note that in principle our protocols can be extended to tolerate Byzantine 
adversaries without affecting the resilience of t < n/ 3, using known techniques for 
asynchronous verifiable secret sharing 10 and zero-knowledge proofs IfTOl . Further- 
more, as shown in IfTTl-Chanter 7], our protocols remain secure even under arbitrary 
composition. 

The cost of our approach is a higher communication complexity. Specifically, if k 
is the security parameter of the system, our protocols transmit a total of 0{kn i ) bits 
across the network using 0(n 3 ) messages, whereas the (optimized) solution of Cachin 
et al. 19) transmits only 0(kn 3 ) bits using also 0(n 3 ) messages. However, in a practical 
setting, this additional overhead is of little concern as the size of n is typically very small 
relative to k (e.g. 10 vs. 1024). 

Technically, the key to our solutions is a novel proactive pseudorandomness (PPR) 
scheme Ifl2l . with an additional property that we call constructibility. Such a scheme 
provides at every phase to every server Pj a random value pr i which remains hidden from 
the adversary. Additionally, it enables the honest servers to jointly reconstruct any such 
value pr. t . We then build our JRSS and PSS schemes such that a server Pi derives all its 
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random choices from its value pr\ by using it as a seed to a pseudorandom function irm . 
This allows the honest servers to reproduce the steps of a (possibly) faulty server in 
public, instead of agreeing on a set of such servers and then excluding them from the 
computation (as it is done by previous work). 

Related Work. As mentioned previously, Cachin et al. (9) implemented asynchronous 
proactive protocols using an agreement subprotocol as a building block, which results in 
a relatively high round complexity. Zhou fT4ll proposed to build proactive cryptosystems 
on a weaker notion of PSS, which can be implemented without agreement. In this weaker 
PSS protocol, every server computes in every phase a list of candidate shares such that 
one of these candidates is the fresh share of the secret. Zhou shows that this suffices to 
implement a proactive version of RS A signatures exploiting the fact that RSA signatures 
are unique in the sense that for any public key and any message, there exists only one 
signature on the given message valid under the given public key. Unfortunately, the 
approach of Zhou lTT4l cannot be applied to proactivize discrete-logarithm signature 
schemes such as ElGamal Ea or dss m, as these schemes are not unique in the 
above sense. The only known technique for proactivizing these signature schemes are 
protocols for JRSS and for PSS in the sense we introduced them before. 

Organization. In the next section we introduce our system model, and recall the defi- 
nitions of cryptographic tools we use in the proposed solutions. In Section[3]we give an 
overview of our constructions. Section [4] presents an efficient secret sharing protocol, 
which will be useful in our constructions. In Section [5] we present our solution for an 
asynchronous proactive pseudorandomness scheme. In Sections[6]and[7] we describe our 
solutions to asynchronous proactive secret sharing, and to asynchronous joint random 
secret sharing, respectively. In Section [8] we sketch how these protocols can be used to 
proactivize public-key signature schemes, considering Schnorr’s signature scheme m 
as an example. Finally, in Section[9]we conclude the paper. 

2 Asynchronous Proactive System Model 

Motivation. Proactive cryptosystems are threshold cryptosystems that operate in a 
sequence of phases. At the beginning of every phase, the servers refresh the shares of 
the underlying threshold system such that the new shares are independent of the old 
shares (except for the fact that they define the same secret). This prevents an adversary 
from learning the shared key, assuming that she corrupts no more than t servers in every 
phase. Such an assumption can be justified if every phase lasts some limited amount 
of real time, the idea being that it takes the adversary a certain amount of real time to 
corrupt a server, and that corruptions are transient, i.e., do not last forever (5). 

This idea maps onto a synchronous network in a straightforward way: one can 
define phases with respect to a common clock accessible to every server and implement 
refresh using a synchronous protocol (8]. The drawback of this approach is that syn- 
chronous protocols proceed in rounds, i.e., messages are sent on a clock “tick”, and are 
received at the next “tick”. This may lead to slow protocols in practice, as the duration 
of a communication round must account for maximal message delays and maximal shifts 
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among local clocks of the servers. Moreover, as the security of synchronous protocols 
relies on the timely delivery of messages, this approach is also vulnerable to timing 
attacks, which are often easy to launch. 

Cachin et. al m suggest to avoid these issues by implementing refresh using an 
asynchronous protocol. Such protocols are message-driven, i.e., proceed as soon as 
messages arrive. This allows a server to terminate a refresh and proceed with the next 
phase as soon as it has received enough information. Moreover, such protocols do not rely 
on upper bounds on message delays or clock shifts, i.e., they are as fast as the network. 
Timing attacks will only slow down such protocols, but not affect their security. 

However, in a purely asynchronous network servers would not have access to a 
common clock for defining phases. Therefore, Cachin et al. (9) suggest to define phases 
locally to every server in terms of a single time signal, or clock tick, that occurs locally 
for a server and only indicates the start of a phase. The idea is to model systems where 
the time signals come from a local clock, say every day at 0:00 UTC, and where the local 
clocks are loosely synchronized, say they agree on which day and hour it is. Hence, the 
model is partially synchronous with long stretches of asynchrony. Such a setting implies 
an upper bound on the real time available to an adversary for corrupting servers in a 
certain phase, which justifies the assumption that an adversary corrupts only t servers in 
the same local phase |S). 

The formal model of (9) does not further constrain the synchronization of phases, 
i.e., it leaves the scheduling of phases up to the adversary. This is to ensure that the 
security of a protocol does not rely on any synchrony assumptions, and hence, is not 
affected by timing attacks. 

Network and Adversary. We adopt the basic system model from 0, which is param- 
eterized by a security parameter k; a function e(k) is called negligible if for all c > 0 
there exists a ko such that e(k) < for all k > fc 0 . The network consists of n servers 
Pi,. .. ,P n and an adversary which are all probabilistic interactive Turing machines 
(PITM) ifTOl that run in polynomial time in k. The random tape of a server is initialized 
at the beginning of the computation, and we assume that the servers can erase informa- 
tion. There is also an initialization algorithm run by a trusted dealer before the system 
starts. On input k, n, t, and further parameters, it generates the state information used to 
initialize the servers. 

Every server operates in a sequence of m(k) local phases, where m(k) is a poly- 
nomial. The phases are defined with respect to dedicated input actions of the form 
(in, clock.tick), scheduled by the adversary. The local phase of a server is defined as the 
number of such input actions it has received. 

The servers are connected by a proactive secure asynchronous network that allows 
every pair of servers to communicate authentically and privately whenever they are 
in the same local phase. The scheduling of the communication is determined by the 
adversary. Formally, we model such a network as follows. There exists a global set of 
messages M. , whose elements are identified by a label ( s , r, l, r) denoting the sender 
s, the receiver r, the length l of the message, and the phase r when the message has 
been sent. The adversary sees the labels of all messages in M. , but not their contents. All 
communication is driven by the adversary, and proceeds in steps as follows. Initially, M. 
is empty. At each step, the adversary performs some computation, chooses a server Pi, 
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and selects some message m £ M. with label (s, i. I , r), where P* must be currently in 
local phase r. The message m is then removed from j\4 , and P, is activated with rn on its 
communication input tape. When activated. Pi reads the contents of its communication 
input tape, performs some computation, and generates one or more response messages, 
which it writes to its communication output tape. Then, the response messages are added 
to M, and control returns to the adversary. This step is repeated arbitrarily often until 
the adversary halts. We view this sequence of steps as logical time, and sometimes use 
the phrase “at a certain point in time” to refer to such a step. Such proactive secure 
asynchronous networks can be implemented based on a secure co-processor 1(181 . or on 
the assumption that the network itself is authentic during short periods of time, allowing 
the exchange of fresh communication keys Ifl9l . 

We assume an adaptive mobile fail-stop adversary. The adversary may corrupt a 
server P, at any point in time by activating it on a special input action. After such an 
event, she may read the entire internal state of Pi, which includes its random tape but 
not previously erased information. Furthermore, she may observe all messages being 
received, until she leaves the server. During such a period of time, we call a server 
corrupted ; at every other point in time, a server is called honest. The adversary may also 
cause a corrupted server to stop executing a protocol. We call an adversary t-limited if 
for any phase r, she corrupts at most t servers that are in a local phase r or r + 1. 

Protocol Execution and Notation. In our model, protocols are invoked by the adversary. 
Every protocol instance is identified by a unique string ID, which is chosen by the 
adversary when it invokes the instance. For a protocol instance ID , we model the specific 
input and output actions of a server in terms of messages of the form (ID, in, ... ) 
and (ID, out, . . . ) that a server may receive and produce, respectively. Messages that 
servers send to each other over the network on behalf of an instance ID have the form 
(ID, type, . . . ), where type is defined by the protocol. We call a message associated 
with a protocol instance ID if it is of the form (ID , . . . ). 

We describe a protocol in terms of transition rules that are executed in parallel. Such 
a transition rule consists of a condition on received messages and other state variables, 
and of a sequence of statements to be executed in case the condition is satisfied. We 
define parallel execution of transition rules as follows. When a server is activated and 
the condition of one or more transition rule is satisfied, one such rule is chosen arbitrarily 
and the corresponding statements are executed. This is repeated until no more conditions 
of transition rules are satisfied. Then, the activation of the server is terminated. 

A protocol instance may also invoke another protocol instance by sending it a suit- 
able input action and obtain its output via an output action. We assume that there is an 
appropriate server-internal mechanism which creates the instance for the sub-protocol, 
delivers the input message, and passes the produced output message to the calling pro- 
tocol. Furthermore, we assume that upon termination of a protocol instance, all internal 
variables associated with this instance are erased. 

Efficiency Measures and Termination. We define the message complexity of a protocol 
instance as the number of all associated messages produced by honest servers. It is 
a family of random variables that depend on the adversary and on k. Similarly, the 
communication complexity of a protocol instance is defined as the bit length of all 
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associated messages, and is also a family of such random variables. To define the latency 
(round complexity) of a protocol, we follow the approach of 1201 . where informally 
speaking the latency of an execution is the absolute duration of the execution divided 
by a longest message delay in this execution, where both times are as measured by an 
imaginary external clock. The latency of a protocol is a latency of a worst-case execution. 
(For details see the full version of Il20l . page 6.) 

These quantities define a protocol statistic X, i.e., a family of real-valued, non- 
negative random variables {X^(fc)}, parameterized by the adversary A and the security 
parameter k, where each XA(k ) is a random variable induced by running the system 
with A. We call a protocol statistic uniformly bounded if there exists a fixed polynomial 
p(k) such that for all adversaries A, the probability Pr[X^(fc) > p(k) ] is negligible. 

As usual in asynchronous networks, we require liveness of a protocol, i.e., that “some- 
thing good” eventually happens, only to the extent that the adversary delivers in every 
phase all associated messages among the servers that remain honest during this phase. 
As in im we define termination as the combination of liveness and an efficiency con- 
dition, which requires a protocol to have uniformly bounded message complexity, i.e., 
the number of messages produced by the protocol is independent of the adversary. 
Cryptographic Assumptions. Our constructions are based on the assumption that there 
exists pseudo-random functions rra defined as follows (sketch): Let Tk denote the set of 
functions from {0, l} fc — * {0, l} fc , and let e Gr Dom denote the process of choosing an 
element e uniformly at random from domain Dom. Finally, let D* denote the execution 
of an algorithm D when given oracle access to /, where / is a random variable over Tk ■ 
We say that D with oracle access distinguishes between two random variables ip and 
g over Tk with gap s{k), if | Pr[D^(l fc ) = 1] — Pr[D ff (l fc ) = 1] | = s(k). We say a 
random variable ip over Tk is s(fc) -pseudorandom, if no polynomial time in k algorithm 
D with oracle access distinguishes ip from g G^Tk with gap s(k). 

A function family d'k = {V , l}je{o,i} fc (with ipi G Tk) is called s(k)-pseudorandom, 
if the random variable ipi for l Gr {0, l} fe is s (k) -pseudorandom. If s(k) is negligible, 
the collection {d'kjkeN is called pseudorandom. We consider pseudorandom collections 
which are efficiently constructible, i.e., there exists a polynomial time algorithm that on 
input l, x e {0, l} k outputs ipi(x). 

Pseudorandom function families can be constructed from any pseudorandom gener- 
ator Ifl3ll . which in turn could be constructed from any one-way function El . Alterna- 
tively, one could trust and use much simpler constructions based on AES or other widely 
available cryptographic functions. 

In our protocols we make use also of distributed pseudorandom functions (DPRF), 
as introduced by Naor et al. Ell . In a DPRF the ability to evaluate the function is 
distributed among the servers, such that any authorized subset of the servers can evaluate 
the function, while no unauthorized subset gets any information about the function. For 
example, in a threshold DPRF the authorization to the evaluation of the functions is 
determined by the cardinality of the subset of the servers. In the sequel, we denote 
by <&k = {<Pi}ie{o,i} k a family of efficiently constructible distributed pseudorandom 
functions. Moreover, we assume that if ( Pk denotes a DPRF with threshold k, and if 
every server holds a polynomial re-out-n share r, of a seed r (where all rfs are from 
the same domain as r) then tp r (x) can be efficiently computed from any set of k values 
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ip ri ( x ) for any position x G {0, l} fe . Threshold DPRFs with this property are also called 
non-interactive. Nielsen 12411 showed how to construct efficiently such non-interactive 
threshold DPRFs based on the decisional Diffie-Hellman assumption l25l . 

3 Technical Roadmap 

Hybrid Secret Sharing. A basic tool we need is a n-out-n hybrid secret sharing scheme: 
it allows a dealer to share a secret value among all other servers, such that every server 
receives an additive n-out-n share of the secret, as well as a K-out-n backup share of 
every other server’s additive share (t + 1 < k < n) . Moreover, it guarantees to terminate 
for any server if the dealer is honest; otherwise, it either terminates for none or for all 
honest servers. Details of our scheme are given in Sectional 

Reconstructible Proactive Pseudorandomness (PPR). The key to our solutions for 
proactive secret sharing and for joint random secret sharing is a reconstructible PPR 
scheme. Such a scheme provides at every phase r to every server Pj a secret value pr T l 
which looks completely random to the adversary. Furthermore, any set of n — t servers 
must be able to reconstruct the value pr T j of any other server Pj without affecting the 
secrecy of the random value pr T 'j computed by this server in another phase t' / =r. 

Our implementation assumes a trusted dealer that provides in the first phase every 
server Pi with a random key n, and with a (n — f)-out-n backup share rji of every 
other server’s key ry . The idea is to compute pr T as <p n (c), where {pi} is a DPRF 
with threshold {n — t), and c is some constant (pseudorandomness and constructibility 
of pr T i then follows by the properties of DPRFs). This approach requires the servers to 
refresh in every phase their keys r,* (and shares r h, . . . , r ni ) such that the fresh keys of 
honest servers are unknown to the adversary. This can be done as follows. 

In a first step, Pi shares the pseudorandom value ip ri (a) (where a denotes some 
public constant) among all other servers using a {n — t)-out-n hybrid secret sharing 
scheme, where it derives all random choices using its current key r, as a seed to a 
pseudorandom function. It then computes its new key r\ as the sum of the additive 
shares provided by all these hybrid secret sharing schemes (the new shares r' u , . . . , r' ni 
are computed as the sum of all provided backup shares). To do this. Pi waits until n — t 
servers have completed their sharing scheme as a dealer; for every other server Pj, it 
reveals the share ry,;. It can now simply wait until either Pj ’ s sharing scheme terminates, 
or until it receives enough shares Vji from other servers Pi to reconstruct ry and derive 
the missing shares thereof; since a sharing scheme terminates either for none or for all 
servers, one of the two cases eventually happens. 

Notice that the servers need not agree on whether to derive the missing shares from 
the sharing schemes, or from the reconstructed key ry, as both ways provide the same 
values. Our protocol ensures that there is at least one honest server whose sharing scheme 
is not reconstructed. This ensures secrecy of the new keys r •. 

Proactive Secret Sharing (PSS). Suppose that at the beginning of the computation, a 
trusted dealer shares a secret s among the servers. To prevent a mobile adversary from 
learning s, the servers have to compute fresh shares of s whenever they enter a new 
phase. This can be done using a proactive secret sharing scheme. 
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Our implementation for PSS relies on an underlying PPR scheme (initialized by the 
dealer). Furthermore, it assumes that the trusted dealer initially provides every server 
with an additive share of the secret s, and with a (t + l)-out-n backup share of every 
other server’s additive share. 

In an epoch r, the servers refresh their shares of the secret by first re-sharing then- 
additive share of s using a (t + l)-out-n hybrid sharing scheme; in this step, every server 
Pi derives all its random choices by using the current random value pr T i (provided by 
the PPR scheme) as a seed to a pseudorandom function. 

As in the PPR scheme, every server then computes its fresh additive share of s as the 
sum of the additive shares provided by all re-sharing protocols (the backup shares are 
computed analogously). It therefore waits for n — t re-sharing schemes to terminate, and 
reconstructs the remaining schemes in public. This can be done by reconstructing for 
every corresponding dealer P 3 the random value pr T j as well as Pj ’s current additive 
share of the secret. Reconstructing pr T j can be done using the reconstruction mechanism 
of the PPR scheme, whereas Pj ’s additive share can be reconstructed by revealing the 
corresponding backup shares. 

Joint Random Secret Sharing (JRSS). The goal of a JRSS protocol is to provide 
every server with a (t + l)-out-n share of a random value e unknown by the adversary. 
It can be executed repeatedly during the phases. Our implementation works exactly as 
the above protocol for refreshing a sharing, except for the following differences. In an 
instance with tag ID of protocol JRSS, a server Pj derives its random choices from the 
(pseudo)random value tp ri (ID) (as opposed to pr T i = tp Ti {c)), where r,; and {pi} is 
the current key of Pj and the DPRF, respectively, used by the underlying PPR scheme. It 
then shares a random value e* and proceeds as above. If the sharing scheme of a server 
Pj needs to be reconstructed, the servers reconstruct only the corresponding randomness 
<p r . (ID). Adding up all backup shares provided by the sharing schemes yields the desired 
(t + l)-out-n share of the random value e = e\ + h e n . 

Building Proactive Cryptosystems. Our protocols for PSS and for JRSS allow to build 
proactive versions of a large class of discrete logarithm-based cryptosystems without 
the use of expensive agreement sub-protocols. The idea is to share the key of the cryp- 
tosystem using our PSS protocol, and to accomplish the cryptographic operation using 
a distributed protocol. Such a protocol can be derived by combining our JRSS protocol 
with known techniques from threshold cryptography. We illustrate this idea in Section^ 
considering Schnorr’s signature scheme fT71l as example. 

4 Hybrid Secret Sharing 

In this section, we describe the syntax and security properties of our protocol for hy- 
brid secret sharing, HybridShare„., which will serve as a basic tool in our subsequent 
constructions. A description and analysis of the protocol is given in IflTl . 

Intuitively, our hybrid secret sharing protocol allows a dealer to share a secret s 
among n servers in such a way that every server Pi computes an additive share s* 
of the secret, and a K-out-n backup share sji of every other server’s additive share, 
where t + 1 < k < n (the idea of backing up additive shares is inspired by ESI). 
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Our specification treats the randomness r used by the dealer as an explicit parameter, 
and requires that the share of every server is a deterministic function of s and r. This 
constructibility of the shares will be essential for our purposes. 

Formally, our sharing protocol HybridShare,. has the following syntax. Let F g be an 
arbitrary finite field, denoting the domain of secrets. There is a distinguished server Pd 
called the dealer which activates an instance ID.d of HybridShare„. upon receiving an 
input of the form (ID.d, in, share, s, r), where s?F, and r £ {0, 1 } k ; if this happens, 
we also say the dealer shares s over F ? using randomness r through ID.d. Every other 
server activates ID.d upon receiving a message (ID.d, in, share). A server terminates 
ID.d when it produces an output of the form (ID.d, out, shared, si*, . . . , s n i), where 

i, . . . , S n i £ Fg. 

Our protocol HybridShare„. has message complexity of 0(n 2 ), communication com- 
plexity of 0(kn 3 ) bits, and round complexity equal four. Furthermore, for any f-limited 
adversary where t < the following holds: Whenever a dealer shares a secret s over 
F g using randomness r through an instance ID.d of HybridShare„., it holds that: 

Liveness: If the dealer is honest throughout ID.d, then all honest servers terminate 
ID.d, provided all servers activate ID.d in the same phase r, and the adversary 
delivers all messages among servers honest during phase r. 

Agreement: If one honest server terminates ID.d, then all honest servers terminate 
ID.d, provided all servers activate ID.d in the same phase r, and the adversary 
delivers all messages among servers honest during phase r. 

Correctness: The values s and r uniquely define n polynomials fj (a;) £ F ? [ x ] for 
j £ [1, n) of degree re, such that s = /y(0), and the following holds: If a 

server Pj outputs Si, su, . . . , s n i, then /,( 0) = s t and fj(i ) = Sji for j £ [1, n]. 
Privacy: If the dealer is honest throughout ID.d, and s and r are uniformly distributed 
in F ? and {0, 1 } fc , respectively, then the adversary cannot guess s with probability 
significantly better than l/|Fg|. 

Efficiency: The message complexity of ID.d is uniformly bounded. 

5 Asynchronous Reconstructible Proactive Pseudorandomness 

In this section we give a definition for an asynchronous reconstructible PPR scheme 
along the lines of Ifl2l . and describe our implementation. The security proof of the 
scheme is contained in the full version of the paper. 

5.1 Definition 

Let l(k) be a fixed polynomial. An asynchronous reconstructible proactive pseudoran- 
domness scheme consists of a probabilistic setup algorithm o, a proactive pseudoran- 
domness protocol 7T, and a reconstruction protocol p. An instance of such a scheme has 
an associated tag ID and works as follows. 

The setup algorithm o produces the initial state information state o,% and the initial 
random value pr 0 i of every server P, . It is executed at the beginning of the compu- 
tation by a trusted dealer. At the beginning of every phase r £ [1, m(k)\, the servers 
execute an instance ID | ppr.r of it to compute a fresh pseudorandom value for phase 
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r. The input action for server T\ carries the state information state T -i j of the previ- 
ous phase, and has the form (ID|ppr.r, in, state r -x,i )• The output action comprises the 
pseudorandom value pr T i and the updated state information state T l . It has the form 
(ID | ppr.r, out, pr T state T j). If P, does not produce an output in phase r (which could 
be the case if the server was corrupted and halted in the previous phase) then its input 
state Tt i to the subsequent instance of tt is the empty input _L. 

In every phase r G [1 ,m(k)\, the servers may execute an instance ID\recj.r of 
protocol p to reconstruct the current pseudorandom value of server Pj . The corresponding 
input and output actions have the form ( ID\recj.r , in, state Ti j), and (IDjrecy.r, out, z-i), 
respectively, where state T l denotes the current state information of Pi. We say a server 
reconstructs a value Zifor Pj, if it outputs a message (ID\recj.r, out, z.- L ) . 

As in m, we define the security requirements with respect to the following on-line 
attack : The scheme is run in the presence of a f-limited adversary for m(k) phases. At 
every phase r, the adversary may also instruct the servers to reconstruct the value pr T 
of any server. At a certain phase l (chosen adaptively by the adversary), the adversary 
chooses an honest server Pj whose value pr T j is not reconstructed at that phase. She 
is then given a test value v, and the execution of the scheme is resumed for phases 
l + l, , m(k). (Our definition will require that the adversary is unable to say whether 
v is Pj ’s output at phase l, or a random value.) 

For an instance ID of a PPR scheme and an adversary A, let A(ID, PR) denote the 
output of A after an on-line attack on ID, when v is indeed the output of Py, similarly, 
let A(ID, R ) denote the corresponding output when v is a random value. 

Definition 1. Let a, n, and p be given as above. We call (a, n, p) a f -resilient asyn- 
chronous reconstructible proactive pseudorandomness scheme if for every instance ID, 
and every t-limited adversary A the following properties hold: 

Liveness: Every server Pi honest throughout a phase r G [1 , m(k)\ terminates in- 
stance ID | ppr.r in phase t, provided that in every phase t' G [1, r], the adversary 
activates each server honest throughout t' on ID | ppr.r', and delivers all associated 
messages among servers honest during phase r'. Furthermore, if every such server 
Pi subsequently activates ID \ rec j .t for some j G [1, n], it reconstructs some value 
Zi for Pj, provided the adversary delivers all associated messages among servers 
honest during phase r. 

Correctness: If a server Pj outputs (ID, out, pr T j, state T> j) in some phase r G 
[1, m(k)\, and another server Pi reconstructs Zifor Pj in phase r, then Zi = pr T j. 
Pseudorandomness: | Pr[A(ID. PR) = 1] — Pr [A(ID, R) = 1] | is negligible. 
Efficiency: The message complexity of an instance of n is uniformly bounded. 

5.2 Implementation 

Let <I>k = o,i} fc denote a DPRF with threshold n — t, and a, b, c denote distinct 

arbitrary constants in the domain of !>/,,. For convenience, we view elements from {0, 1 } k 
as elements from W 2 k (and conversely), according to some fixed bijective map from 
{0, l} k to F 2 k . All computations are done over F 2 fc . 

The Setup Algorithm o ppr . The setup algorithm provides to every server Pi a ran- 
dom value ri G F 2 fc , and a (t + l)-out-n share rj, G F 2 * of the random value 
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of every other server. It therefore chooses n random polynomials fi(x) G F 2 fc [x] 
of degree t for i G [l,n]. The initial state information of a server P t is defined as 
stateo^ = (/*(()). . . . , /„('<)). The initial pseudorandom value is computed as 

P r o,i V/ f (o)(c). 

The Reconstruction Protocol p ppr . Let r t , r u , ■ ■ • , r n i denote Pj’s local input to an 
instance ID\recj.r of protocol p ppr . Reconstructing the pseudorandom value pr T j of 
server Pj is straightforward. Every server Pi computes pr T J - i <— <p rji (c), and sends 
it to every other server. Using the reconstruction mechanism of <Pk, every server can 
compute pr T j upon receiving n — t “shares” pr T j rn from other servers P m . 

The Asynchronous Proactive Pseudorandomness Protocol 7r ppr . Let r t . m , . . . ,r„i 

denote server Pj’s local input state T _i, to instance /P|ppr.r of 7r ppr . To refresh this 
sharing, and to compute fresh pseudorandom values {pr T ?: }, every server Pi executes 
the following transition rules in parallel. 

Share: When Pj invokes the protocol with non-empty input, it shares the pseudo- 
random value <p ri ( a) over F 2 fc using randomness p Ti (b) through an instance 
ID|ppr.r|share.i of protocol HybridShare ra _ t . 

Share-Termination: Whenever Pj terminates a sharing protocol /P|ppr.r|share.j, 
it stores the corresponding output in the local variables dji, dju, . . . , d ;m . If the 
(n — t)’th such sharing protocol has terminated and Pj has received non-empty 
input before, it sends to all servers a reveal message containing the values 'Pr mi (a) 
and <Pr mi (b) for servers P m whose sharing protocol did not terminate yet. 
Reconstruct: Whenever Pj receives n — t values <p rmi (a) , <pr m( (b) for a server P m , it 
reconstructs ip rm (a) and p Tm (b) using the reconstruction mechanism of P>k ■ It then 
computes the values d m j, dmii, • ■ • , dmni as the i’th share when sharing a secret 
p rm (a) using randomness ip rm (b) according to protocol HybridShare n _ t . 
Combine: When Pi has computed values dji, dju,..., dj n i for every j G [1, n], it 
computes its local output values pr T i and state Tt i = (r' ; , 7"^, . . . , r’ ni ) as r\ f— 
^"=i dji, r ' m j f— Y%= i djmi for m G [1, n), and pr Ti *- (p r '.( c). 

The scheme guarantees pseudorandomness because the pseudorandom values ip rh (a) 
and ip rh (b) of at least one honest server remain hidden from the adversary. This is 
guaranteed because all honest servers together reveal at most ( n — i)t “shares” <p rij (a) 
and </v y (b). But to reconstruct ip ri ( a) and <p ri (b) of all ( n — t) honest servers, the 
adversary needs at least (n — f) (n — 2 1) > ( n — t){t + 1) such shares, as the threshold 
of \Pk is (n — t). 

The reason why the scheme avoids an agreement (while preserving constructibility) 
is the following: if an honest server Pj terminates the protocol ID |ppr.r|share.j and 
computes the tuple (dji, dju , . . . , djm), then this is the same tuple it would compute by 
first reconstructing the randomness r ; of Pj from backup shares, and then reproducing 
the computations of Pj in the sharing protocol ID |ppr.r|share.y. Hence, the servers do 
not have to agree whether to compute their share of Pj ’s sharing protocol by the Share- 
Termination or the Reconstruct transition rule, respectively, as both rules provide 
the same share. We prove the following theorem in m 
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Theorem 1. (cr ppr , 7r ppr , /o ppr ) is a t-resilient asynchronous reconstructible proactive 
pseudorandomness scheme for t < n/3. It has a latency of five rounds, uses 0(n 3 ) 
messages, and has a communication complexity ofO(kn 4 ) bits. 


6 Refreshing a Sharing 

In this section we define an asynchronous PSS scheme along the lines of m , and sketch 
our implementation. The security proof of the scheme can be found in m. 

6.1 Definition 

Let K denote the domain of possible secrets, S denote the domain of possible shares, 
and l(k ) a fixed polynomial. An asynchronous proactive secret sharing scheme consists 
of a setup algorithm a, a proactive refresh protocol n, and a reconstruction protocol p. 
An instance of a PSS has a tag ID and works as follows. 

The setup algorithm produces for each server Pi the initial state information stateo,i 
and the initial share s 0 ,i £ S of the secret. It is executed at the beginning of the computa- 
tion by the trusted dealer. At the beginning of every phase r £ [1, m(k)} the servers exe- 
cute an instance ID |ref.r of protocol 7r to refresh the old share s T _i , , and to update the 
state state T -\ t i. The corresponding input and output actions of server Pi have the form 
(IDjref.r, in, s T -i,i> state T - iy) and (IDjref.r, out, .syy , state Ttl ), respectively, where 
s T -i t i and state T _iy equal _L in case Pi did not produce an output in phase r — 1. 

In every phase r £ [1, rri(k)}, the servers may execute an instance ID|rec.r of 
protocol p to reconstruct the secret. The input and output actions for server P, have 
the form (/Djrec.r, in, s T y), and (IDjrec.r, out, z,), respectively, where s T y denotes the 
current share as computed by the instance ID |ref.r. We say that a server reconstructs a 
value Zi, when it outputs a message (ID|rec.r, out, zf). 

Definition 2. Let a, w, and p be given as above. We call (a, n, p) a t-resilient asyn- 
chronous proactive secret sharing scheme, if for every instance ID, and every t-limited 
adversary the following properties hold: 

Liveness: Every server Pi honest throughout a phaser £ [1, m(k)] terminates instance 
ID\ref.r in phaser, provided that in every phaser' £ [l,r], the adversary activates 
every server honest throughout phase t' on ID | ref. r', and delivers all associated 
messages among servers honest during phase t'. Further, if every such Pi subse- 
quently activates ID|rec.r, it reconstructs some value Zi, provided the adversary 
delivers all associated messages among servers honest during phase r. 
Correctness: After initialization, there exists a fixed value s £ K. Moreover, if an 
honest server reconstructs a value Zi, then Zi = s. 

Privacy: As long as no honest server activates an instance of p, the adversary cannot 
guess s with probability significantly better than \/\K |. 

Efficiency: The message complexity of tt and p is uniformly bounded. 

We stress that the security of the sharing does not depend on the timely delivery of 
messages. Even if the adversary fails to deliver the messages within prescribed phase, 
the privacy of the shared secret is not compromised. 
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6.2 Implementation 

Our implementation of the PSS scheme is a suitable example to illustrate how the PPR 
scheme introduced in the previous section can be used to avoid the need for agreement 
even if it seems to be inherently necessary. We therefore briefly recall the standard 
solution 13 for PSS that depends on agreement. Here, every server initially receives 
a (f + 1 ) -out-n share of the secret. To refresh the shares, every server provides every 
other server with a (t + 1) -out-n sub-share of its own share, using a suitable sharing 
scheme. The servers then agree on a set of at least t+ 1 servers whose re-sharing scheme 
terminates for all honest servers, and compute the new share as the linear combination 
of the received sub-shares (with Lagrange coefficients). 

We follow the same approach (see Section^, but avoid agreement by reconstructing 
the re-sharing schemes of the slowest (possibly crashed) servers in public. However, 
this approach only works if the publicly reconstructed sub-shares are identical to the 
ones which the re-sharing scheme would produce. Otherwise, the servers would again 
have to agree on which sub-shares to reconstruct, and which to take from the re-sharing 
schemes. This is where the PPR scheme comes in handy, as it allows to reconstruct the 
random choices made by a server when it is re-sharing its share. The technical details 
are given below. Let the domain of possible secrets be a field F g where q < 2 k . All 
computations are in F q or F 2 t , as is clear from the context. 

The Setup Algorithm f7 pss . The setup algorithm provides every server with an additive 
share s* of a randomly chosen secret, and with a (f + 1) -out-n share Sji of every other 
server’s additive share. It therefore chooses n random polynomials fi(x) G Z q [x] of 
degree t for i e [1, n] (the secret is defined as s = Y^i=\ s *)- The initial share of server 
Pi is defined as so,» = (a*, . . . , s ni ), where s, = /j(0) and Sji = 

Additionally, the setup algorithm provides every server with the initial state informa- 
tion needed to initialize a PPR scheme. It therefore runs the setup algorithm cr ppr , and 
computes the initial state information statea^ of server Pi as the tuple (state'll, pr 0 i ) 

The Reconstruction Protocol p pss . The reconstruction protocol is straight forward. 
Every server P 4 sends its input s r .i — (sj, S \. t . . . . , s„j) to every other server. Upon 
receiving t+ 1 such values the server interpolates all missing shares Sj from the received 
sub-shares Sji by Lagrange interpolation, and computes the secret as s = J2j= i s j ■ 

The Refresh Protocol 7r pss . Let (,s,;, .... s n i) and (stafe^j i ,pr T _ 1 ,) denote 

server Pj’s local input and state T - respectively, to instance ID | ref .r. To com- 
pute a fresh share (s', s' u , . . . . s' ni ) and updated state information (state'll, pr T { ), every 
server Pi executes the following transition rules in parallel: 

Share: When Pi invokes the protocol, it activates an instance IDjppr.r of protocol 
TTppr with input state^ r _ l i to compute (state'll, pr T j. Furthermore, if Pi received 
non-empty input, it shares its share Sj over F ? using randomness pr T _- i ,, through 
an instance ID|ref.r|sharei of protocol HybridShare t+1 . 

Share-Termination: Whenever P* terminates an instance /P | ref. r (share, j of a shar- 
ing protocol , it stores the corresponding output in the local variables e^, 
Eju, . ej n i. If for n — t servers P t the corresponding protocols ID |ref.r|share.j 
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have terminated, it sends the indices of all servers whose sharing protocol did not 
terminate yet to every other server in a missing message. 

Reveal: If for some index m, Pi receives (n — i) missing messages from other servers 
containing this index and has received non-empty input before, it sends a reveal 
message to every other server containing the backup share s m , and the index nn. 
Next, it activates the instance ID |rec m .r of protocol p ppr with input state^. p f 1 i to 
reconstruct the randomness pr T _ 1 m of P m . 

Reconstruct: Whenever Pi receives (t + 1) reveal messages for the same index m 
and reconstructs the value pr T _ 1 m for P m , it computes the share s m from the 
received backup shares by Lagrange interpolation. It then computes the tuple (e m i, 
e m u, ■ ■ ■ , Gmni) as the i’th share when sharing s m using randomness pr T _ 1 m . 
Combine: When Pi has computed values (e mi , e mli , . . . , e mm ) for all m G [1, n], 
it computes the new share (.s', s ' u , . . . , s' ni ) as follows: .s' <— i s ' m i <— 
X)"= i ejmi for m G [1, n]. 

Notice that the protocol has the same message flow as the pseudorandomness protocol 
7Tppr, except for the additional missing messages. They ensure the secrecy of the share Sh 
of at least one honest server Ph, and are needed because the servers hold a (t + l)-out-n 
hybrid sharing of the secret s. We remark that for refreshing a (n — t)-out-n hybrid 
sharing, the servers could omit waiting for t + 1 such messages, and could execute the 
Reveal rule directly at the end of the Share-Termination rule. This would save one 
communication round. The proof of the following theorem can be found in m. 

Theorem 2 . The tuple (<7 pss , 7r pss , p pss ) is a t-resilient asynchronous proactive secret 
sharing scheme for t < n/ 3 . The refresh protocol n pBS uses 0 (n 3 ) messages, has latency 
of six rounds and communication complexity ofO(kn 4 ‘). 


7 Asynchronous Proactive Joint Random Secret Sharing 

The goal of an asynchronous proactive joint random secret sharing scheme is to enable 
the servers to repeatedly generate ( t + l)-out-n sharings of random values, such that the 
random values remain hidden from the adversary. Due to lack of space, we only sketch 
the definition and implementation. 

Definition. An asynchronous proactive joint random secret sharing (JRSS) scheme 
consists of a setup algorithm o , a proactive update protocol n, a joint random secret 
sharing protocol 7, and a reconstruction protocol p. An instance of such a scheme has a 
tag ID and works as follows. 

At the beginning of the computation, a trusted dealer executes the setup algorithm a 
and provides every server with its initial state information stateo,i- At the beginning of 
every phase r G [1, m(k)}, the servers execute protocol tt to update the state information 
{state T _\^} . During every phase r G [1, rri(k)\, the servers can repeatedly execute 
protocol 7 to generate a sharing of a random value z c in a domain K. Every such 
instance has a unique tag ID |gen c . For every server Pi, it takes the current state infor- 
mation state T> i as input, and produces as output a share s C) j of the random value z c . These 
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shares may serve as input to the reconstruction protocol p with tag ID\rec c , which 
produces for every server P t a value z c j as output. 

For a JRSS scheme to be secure, we require that when the first server completes an 
instance ID |gen c , there is a fixed value z c such that the following holds: (Correctness) If 
a server Pi terminates ID |rec c and outputs z c j_, then z Ct i = z c . Furthermore, (Privacy) as 
long as no honest server activates ID | rec C) the adversary cannot guess z c with probability 
significantly better than 1/\K\. 

Implementation. Our implementation builds on our PPR scheme ( a ppr , 7r ppr , p ppr ). Let 
4> k = {( pi} denote the DPRF family used by the PPR scheme, a and b denote two distinct 
constants, and H : {0, 1}* — > {0, l} fe denote a collision resistant hash function (it is 
well-known how to construct such functions from standard computational assumptions 
such as the hardness of the discrete-logarithm problem). 

The state information {state T ^} of our JRSS scheme comprises only the state in- 
formation of our PPR scheme, i.e., state T j_ = . . . , r n f). Protocols cr jrss and 

7Tj rss for setting up and refreshing this state, respectively, consist only of calling the 
protocols a ppr and 7T ppr . The protocol 7 j rss for generating sharings of random values 
in {0, l} fc works as follows. Given input state T l = (n, ru, . . . , r n j) to an instance 
ID | gen c of 7 j rss , every server Pi performs the following steps (all computations are done 
in F 2 fc)- 

Share: When Pi invokes the protocol with non-empty input, it shares 
ip ri (H (ID | gen c | a)) over F 2 k through an instance of protocol HybridShare t+1 with 
tag 7D|gen c |share.i using randomness ip ri (H(ID |gen c |b)). 

Share-Termination: Whenever P* terminates a sharing protocol ID|gen c |share.j, it 
stores the corresponding output in local variables eji, eju, . . . , 5j ni . Once n — t 
sharing protocols have terminated and Pi has received non-empty input before, 
it sends to all servers a reveal message containing values ip rmi (H(ID |gen c |a)) 
and ip rmi (H(ID |gen c |b)) for servers P m whose sharing protocol did not terminate 
yet. 

Reconstruct: Upon receiving n—t reveal messages for the same index to, Pi recon- 
structs values ip rm (H(ID |gen c |a)) and ip rrn (H(ID |gen c |b)) (using the threshold 
evaluation property of <P k ) and derives the missing sub-share e mi , e m ii, ■ ■ ■ , Irani ■ 
Combine: When P* has computed values (e m j, e m u , . . . , e mn! ;) for every to £ [1, n], it 
computes S C; , = (Sj, Sli, . . . , S n i) as follows: Sj <— J2j=l s mi YL'j-l Ijini 
forme [l,n]. 

The shared secret value z c is never reconstructed but equals s i- The protocol 
has a latency of five rounds, a message complexity of 0(n 3 ), and a communication 
complexity of 0(kn i ) bits. 

An instance ID |rec c of the reconstruction protocol Pj rss works as follows. Every 
server i sends its share s c i = (si,su, . . . ,s n i) — which it receives as input — to every 
other server. Upon receiving t + 1 such values, P, derives all values s :j from the received 
sub-shares Sj m by Lagrange interpolation and computes the secret as z c = Y^j=i s j ■ 
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8 A Simple Proactive Secure Signature Scheme 

Our protocols for PSS and JRSS can be used to proactivize a large class of discrete- 
logarithm based public-key cryptosystems for signing and encryption. In this section, 
we sketch how this can be done considering Schnorr’s signature scheme as an example. 

Let p denote a large prime, and ( g ) denote a multiplicative subgroup of Z* of prime 
order q such that q\p — 1. In the regular centralized Schnorr signature scheme, the secret 
key x of the signer is a random element from Z ? , and the public key is y = g x . To sign 
a message m e {0, 1}*, the signer picks a random number r £ Z 9 , and computes the 
signature (p, a) as p <— (f mod p and a «— r + H(m\\p)x mod q. A signature (p, a) 
on a message m can then be verified by checking that g a = py H ( m \\p'> mod p. 

In a proactive signature scheme, the power to sign a message is distributed among 
the servers such that in every epoch, only a set of at least t + 1 servers can generate 
valid signatures, whereas any smaller set can neither compute a signature nor prevent the 
overall system from operating correctly. For a formal treatment of proactive signature 
schemes we refer to m. 

Proactivizing Schnorr’s signature scheme in the above sense can be done as follows. 
First, a trusted dealer chooses the values p, q, g, x as in the standard Schnorr scheme, 
and initializes a PSS scheme with a sharing of x. It also initializes a JRSS scheme, 
and announces the public parameters p, q. g and y. To compute a signature (p, a) on a 
message m, every server i performs the following steps: 

generate p = g r : 

(1) Use the underlying JRSS scheme to compute a (t+ l)-out-n share r, of a random 
value r€Z,. 

(2) Reveal the value pi = g r ' mod p to all other servers. 

(3) Upon receiving t + 1 values pj , compute p from the values pj by using Lagrange 
interpolation in the exponent, i.e., p <— n,cQ Pj 3 m od p. Here, Q denotes the 
indices of the received values pi, and A,, the Lagrange interpolation coefficient for 
the set Q and position 0. 

generate a = r + H(m\\p)x: 

(1) Reveal the value <r ; ; = r,; +■ H(m\\p)xi mod q to all other servers; here, Xi 
denotes server i’s current share of x as computed by the underlying PSS scheme. 

(2) Upon receiving t + 1 values cjj , compute a by using Lagrange interpolation, i.e., 
cr <— Yljes ^J a j m °d q. Here, S denotes the indices of the received values <jj, 
and Xj the Lagrange coefficients for the set S and position 0. 

Verification of the computed signature can be done exactly as in the centralized 
Schnorr scheme. One can show that this proactive signature scheme is as secure as the 
centralized Schnorr scheme in the following sense: If there exists a t-limited mobile 
adversary against the proactive signature scheme that can forge a signature (under an 
adaptively chosen message attack), then there exists an adversary against the centralized 
Schnorr scheme that can forge signatures (under an adaptively chosen message attack). 

Proactivizing other discrete-logarithm signature schemes such as ElGamal El or 
DSS lfT6ll can be done in a similar way (to solve the inversion problem that occurs in 
DSS, one can use the approach of l27l ). 
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9 Conclusions and Open Problems 

In this paper, we have presented the first asynchronous schemes for proactive secret 
sharing and proactive joint random secret sharing with a bounded worst case complexity. 
Moreover, our solutions run three times faster (in terms of latency) than the best known 
previous solutions. 

The technical novelty of our schemes is that they do not rely on an agreement sub- 
protocol. The fact that agreement can be avoided is surprising on its own, as all known 
previous techniques for implementing such schemes require the servers to have at some 
point a common view of which servers have been crashed. 

A natural open problem is to enhance our techniques to tolerate a Byzantine adversary. 
Here, the main difficulty lies in designing a verifiable version of our hybrid secret sharing 
scheme. In such a scheme, the dealer must be committed to a random value (of the same 
size as the secret), such that every server can verify that the dealer has indeed computed 
the shares by using this random value as a seed to a pseudorandom function. In principle, 
this can be done using the technique of general zero-knowledge proofs IfTOl . We suggest 
it as an open research problem to construct a pseudorandom function together with 
efficient zero-knowledge proofs for this task. 
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Abstract. We consider the problem of increasing the threshold param- 
eter of a secret-sharing scheme after the setup (share distribution) phase, 
without further communication between the dealer and the sharehold- 
ers. Previous solutions to this problem require one to start off with a 
non-standard scheme designed specifically for this purpose, or to have 
communication between shareholders. In contrast, we show how to in- 
crease the threshold parameter of the standard Shamir secret-sharing 
scheme without communication between the shareholders. Our technique 
can thus be applied to existing Shamir schemes even if they were set up 
without consideration to future threshold increases. 

Our method is a new positive cryptographic application for lattice 
reduction algorithms, inspired by recent work on lattice-based list decod- 
ing of Reed-Solomon codes with noise bounded in the Lee norm. We use 
fundamental results from the theory of lattices (Geometry of Numbers) 
to prove quantitative statements about the information-theoretic secu- 
rity of our construction. These lattice-based security proof techniques 
may be of independent interest. 

Keywords: Shamir secret-sharing, changeable threshold, lattice reduc- 
tion, geometry of numbers. 


1 Introduction 

Background. A (f , n)-threshold secret-sharing scheme is a fundamental crypto- 
graphic scheme, which allows a dealer owning a secret to distribute this secret 
among a group of n shareholders in such a way that any t shareholders can 
reconstruct the secret, but no subset of less than t shareholders can gain infor- 
mation on the secret. Classical constructions for (f, n) secret-sharing schemes 
include the polynomial-based Shamir scheme [18] and the integer-based Chinese 
Remainder Theorem (CRT) scheme [2]. 

A common application for (t, n) secret-sharing schemes is for achieving ro- 
bustness of distributed security systems. A distributed system is called robust 
if system security is maintained even against an attacker who manages to break 
into/eavesdrop up to a certain number of components of the distributed system. 
For example, access control to a system can be enforced using a secret shared 
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among n system servers using a (t. n)-thresliold secret-sharing scheme, while 
maintaining security if less than t servers are compromised. In such applica- 
tions, the threshold parameter t must be determined by a security policy, based 
on an assessment which is a compromise between the value of the protected sys- 
tem and attacker capabilities on the one hand (which require as high a threshold 
as possible) and user convenience and cost on the other hand (which require as 
low a threshold as possible). In many settings, the system value and attacker 
capabilities are likely to change over time, thus requiring the security policy 
and hence threshold parameter t to vary over time. In particular, an increase 
in system value or attacker capabilities after the initial setup with a relatively 
low threshold parameter t, will require an increase in the threshold parameter 
to a higher value t' > t. The longer the lifetime of the system, the more likely 
that such a change will be needed. Note that we assume that shareholders will 
cooperate honestly in making the transition to the larger threshold t' > t, since 
the attacker in our setting is an outsider. 

Previous Solutions. A trivial solution to the problem of increasing the threshold 
parameter of a ( t , n)-threshold secret-sharing scheme to t' > t is for the share- 
holders to discard their old shares and for the dealer to distribute new shares of 
a (t',n) secret-sharing scheme to all shareholders. However, this solution is not 
very attractive, since it requires the dealer to be involved after the setup stage 
and moreover requires communication between the dealer and each shareholder 
(such communication may be difficult to establish after the initial setup stage). 

A much better solution would allow the threshold to be changed at any time 
without any communication between the dealer and shareholders after the setup 
stage. We say that such schemes allow dealer-free threshold changeability. A 
trivial dealer-free threshold changeable scheme can be constructed as follows: 
the dealer initially sets up n — t + 1 threshold schemes for each possible future 
threshold t' £ {t.t + 1, , «}, and gives to each shareholder n — t+1 shares 
of the secret. Namely, for each t' £ {t, . . . , n}, the shareholder receives a share 
of the secret for a (t',n)-threshold scheme. Such a trivial scheme may not be 
applicable because of the following drawbacks: 

(1) Non-standard Initial Scheme: The dealer must plan ahead for future thresh- 
old increases by initially setting up a non-standard (t, n)-threshold scheme 
designed specifically for threshold-changeability, whose shares consist of n — 
f+1 shares corresponding to the n—t+1 underlying (tJ . n)-threshold schemes. 
Hence the trivial scheme cannot be applied to increase the threshold of ex- 
isting standard Shamir (t, n)-schemes which were not originally designed for 
threshold changeability and in which each shareholder has only a single share 
of one Shamir (t, n)-scheme. 

(2) Large Storage/ Communication Requirements for Shareholders: Each share- 
holder must receive and store n—t+1 shares, where each share is as long 
as the secret (assuming that perfect security is desired). Hence the trivial 
scheme cannot be applied when storage or communication costs for n — t + 1 
shares are prohibitive. 
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Other ‘dealer-free’ solutions to the threshold increase problem have been 
proposed in the literature (see related work below), but they all suffer from at 
least one of the two drawbacks above, or they require communication between 
the shareholders. 

Our Contributions. In this paper, we present a new method for increasing the 
threshold of the standard Shamir ( t , n)-threshold secret-sharing scheme [TS]. which 
does not have any of the drawbacks discussed above. In particular, and in con- 
trast to previous solutions, our method does not require communication between 
the dealer and shareholders after the initial setup stage nor between sharehold- 
ers, and can be applied to existing Shamir schemes even if they were set up 
without consideration to future threshold increase. Storage and communication 
costs are the same as for the standard Shamir scheme. 

The basic idea of our method is the following: to increase the threshold from 
t to t! > t, the shareholders add an appropriate amount of random noise to 
their shares (or delete a certain fraction of the bits of their share) to compute 
subshares which contain partial information about (e.g. half the most-significant 
bits of) the original shares. Since the subshares contain only partial information 
about the original shares, a set of t subshares may no longer be sufficient to 
reconstruct the secret uniquely, but if one observes a sufficiently larger number 
1/ > t of subshares then one can expect the secret to be uniquely determined by 
these t' subshares (e.g. if the subshares contain only half the information in the 
original shares then one can expect that t' = 2 1 subshares will uniquely determine 
the secret By replacing the share combiner algorithm of the original (t, n)- 
threshold secret-sharing with an appropriate ‘error-correction’ algorithm which 
can uniquely recover the secret from any t' subshares, we obtain the desired 
threshold increase from t to t', leaving the secret unchanged. 

Our efficient ‘error-correction’ combiner algorithm for the Shamir secret- 
sharing scheme is constructed using lattice basis reduction techniques. Thus, 
our method is a new positive cryptographic application for lattice reduction 
algorithms. Furthermore, we make use of fundamental tools from the theory 
of lattices (Geometry of Numbers) to prove quantitative statements about the 
information-theoretic security and correctness of our construction. These lattice- 
based security proof techniques may be of independent interest. 

Although our threshold-increase method does not yield a perfect ( t n) secret- 
sharing scheme, we obtain a useful result about the information-theoretic secu- 
rity of our method, which we believe suffices for many applications. Roughly 
speaking, we prove that for any desired e > 0, our method can be used to change 
the threshold to if > t (meaning that any t' subshares can be used to recover 
the secret) such that any t s <t' — (t'/t) observed subshares leak to the attacker 
at most a fraction e of the entropy of the secret, where e can be made as small 
as we wish by an appropriate choice of security parameter. 


We remark that this intuitive reasoning is not rigorous, and indeed there exist ex- 
amples for which it is incorrect. However, our results show that it is approximately 
true for the Shamir scheme. 
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Interestingly, our lattice-based methods can be adapted also to change the 
threshold of the standard integer-based Chinese Remainder Theorem (CRT) 
secret-sharing scheme [5], We provide full details of this result in a companion 
paper [22] . 

Related Work. Several approaches to changing the parameters of a threshold 
scheme in the absence of the dealer have been proposed in the literature. The 
technique of secret redistribution [51 HB] involves communication among the share- 
holders to ‘redistribute’ the secret with the a threshold parameter. Although this 
technique can be applied to standard secret-sharing schemes, its disadvantage is 
the need for secure channels for communication between shareholders. Methods 
for changing threshold which do not require secure channels have been studied 
in [U[T11[TS][T3] ’ but they all require the initial secret-sharing scheme to be a 
non-standard one, specially designed for threshold increase (as a simple example 
of such a non-standard scheme, the dealer could provide each shareholder with 
two shares of the secret: one share for a (t, n) scheme and one share for a (t',n) 
scheme). 

Our scheme uses a lattice-based ‘error-correction’ algorithm which is a slight 
variant of an algorithm for ‘Noisy Polynomial Approximation’ with noise bounded 
in the Lee norm [20]. This algorithm in turn is one of a large of body of recent 
work on ‘list decoding’ of Reed-Solomon and Chinese Remainder codes [OlHflllfil 
I2T] . We remark also that although the correctness proof of our scheme is based 
on the work of [20], our security proof is new and the lattice-based techniques 
used may be of independent interest. 

Organization of This Paper. Section [2] presents notations, known results on lat- 
tices, and a counting lemma that we use. In Section [3] we provide definitions 
of changeable-threshold secret-sharing schemes and their correctness/security 
notions. In Section[4]we present the original Shamir (t. n)-tlireshold secret shar- 
ing scheme, and our threshold-changing algorithms to increase the threshold to 
t 1 > t. We then provide concrete proofs of the correctness and security proper- 
ties of our scheme. Section [5] concludes the paper. Due to page limitations, some 
proofs have been omitted. They are included in the full version of this paper, 
available on the authors’ web page. 

2 Preliminaries 

2.1 Notation 

Vectors and Polynomials. For a vector v G 1R", we write v = (v[0], . . . , v[n— 1]), 
where, for i = 0, . . . , n — 1, v [i] denotes the itli coordinate of v. Similarly for 
a polynomial a(x) = a[0] + a[ l\x + . . . + a[t — lJaW 1 , we let a[i] denote the 
coefficient of x l . For a ring R, we denote the set of all polynomial of degree at 
most t with coefficients in the ring R by R\x: t). 

Lee and Infinity Norm. For a prime p and an integer z we denote Lee norm 
of z modulo p as ||^||z, )P = min^g^ | z — kp\. Similarly, for a vector v G Z", we 
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define the Lee norm of v modulo p by ||v||l iP = maxo<i<„_i ||v[*]||l jP . For a 
vector z = (zi,...,z n ) G IR", we denote the infinity norm of z by ||z§ :ew = 
maxi<j< n \zi\. For integers a and p, we denote a mod p by [a] p . For real z we 
define Int(z) = |Y| — 1 as the largest integer strictly less than z. 

Sets. For a set S, we denote by #5' the size of S. For any set S and integer n, 
we denote by S n the set of all n-tuples of elements from S and by D(S n ) the 
set of all n-tuples of distinct elements from S. For integer n, we denote by [n] 
the set {1, 2, ... , n}. 

Entropy. We denote by log(.) the logarithm function with base 2. For a discrete 
random variable s with probability distribution P s (.) on a set S, we denote by 
H(s G S) = Ps( x ) log ( 1 /-Ps- (^ ) ) the Shannon entropy of s. Let t be any 

other random variable on a set T, and let u denote any element of T. Let P s (.\u) 
denote the conditional probability distribution of s given the event t = u. We 
denote by H{s G S\u) = J2 x es Ps(x\u) log(l/P s (a;|u)) the conditional entropy 
of s given the event t = u. 

2.2 Lattices 

Here we collect several known results that we use about lattices, which can be 
found in [S1[TU1E]- Let {bi, . . . , b n } be a set of n linearly independent vectors in 
IR". The set 


£ = {z: z = cibi + . . . + c n b n , a ,...,%£Z} 

is called an n-dimensional (full-rank) lattice with basis {bi,...,b n }. Given a 
basis B = (b-| ..... b n ) G IR" for a lattice £, we define the associated basis 
matrix Mc,b to be the (full-rank) n X n matrix whose <th row is the <th basis 
vector bi for i = 1 . . . . , n. The quantity | detiMc.p) is independent of B. It is 
called the determinant of the lattice £ and denoted by det(£). 

Given a basis for lattice £, the problem of finding a shortest non-zero vector in 
£ is known as the shortest vector problem, or SVP. An algorithm is called an SVP 
approximation algorithm with \\-\loo-approximation factor jsvp if it is guaranteed 
to find a non-zero lattice vector c such that UcHoo < 7§ypmin v6£ \o ||v||oo- 
The celebrated LLL algorithm of Lenstra, Lenstra and Lovasz m is a fully 
polynomial time SVP approximation algorithm with || ■ | ^-approximation factor 
7 lll = n 1/,2 2"/ 2 . Also, as shown in[TJ[TT], there exists an SVP approximation 
algorithm with || • H^-approximation factor j ex = n 1 / 2 which polynomial time 
in the size of elements of M c l but not in dimension of £. 

In this paper we actually need to solve a variation of SVP called the closest 
vector problem (CVP): given a basis of a lattice £ in IR" and a “target” vector t G 
IR", find a lattice vector c such that |c— tH^ is minimized. An algorithm is called 
a CVP approximation algorithm with || • \\oo-approximation factor Jcvp if it is 
guaranteed to find a lattice vector c such that ||c — t ||oo < lev p m in v£ £ ||v— tH^. 
Baba,i[3] has shown how to convert the LLL algorithm into a fully polynomial 
CVP approximation algorithm with ||- ||oo-approximation factor 7 b q 6 = nfl <1 2 n l‘ 1 . 
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In our proof of security we use several fundamental theorems from the theory 
of lattices (‘Geometry of Numbers’). The original theorems are quite general, 
but the restricted versions stated below suffice for our purposes. First, we need 
the following definition of successive Minkowski minima of a lattice. 

Definition 1 (Minkowski Minima). Let£ be a lattice mlR". Fori = 1, . . . ,n, 

the ith succesive Minkowski minimum of £, denoted \{C), is the smallest real 
number such that there exists a set {bi, . . . , b* } ofi linearly-independent vectors 
in £ with Hbj-Uoo < A *(£) for all j = 1, . . . ,i. 

Note that Ai (£) is just the shortest infinity-norm over all non-zero vectors in 
£. Next, we state Minkowski’s ‘first theorem’ in the geometry of numbers. 

Theorem 1 (Minkowski’s First Theorem). Let £ be a lattice in IR" and 

let Ai {£) denote the first Minkowski minimum of £ (see Def. Q]). Then Ai(£) < 
det(£)* , 

We will use the following point-counting variant of Minkowski’s ‘first theo- 
rem’, which is due to Blichfeldt and van der Corput(see [8]). 

Theorem 2 (Blichfeldt-Corput). Let £ be a lattice in IR" and let K denote 
the origin- centered box {v G IR" : HvH^ < H} of volume Vol(K) = (2 H) n . 
Then the number of points of the lattice £ contained in the box K is at least 
2 • Int ( 2 " deqx) ) + 1’ where for any z G IR, Int(z) denotes the largest integer 
which is strictly less than z. 

Finally, we will also make use of Minkowski’s ‘second theorem’ [8]. 

Theorem 3 (Minkowski’s Second Theorem). Let £ be a full-rank lattice 
in IR" and let Ai(£),. . . ,X n (£) denote the n Minkowski minima of £ (see Defi- 
nition} Ip. Then X\(£) • • • X n (£) < 2"det(£). 

2.3 An Algebraic Counting Lemma 

The following is a fundamental lemma that we use, interestingly, for both the 
correctness and security proofs of our construction. Fix a prime p defining J;he 
finite field 2 P , positive integer parameters ( n,t,H ), and an arbitrary set A of 
polynomials of degree at least 1 and at most t over 1L V . The lemma gives us an 
upper bound on the probability that, for n randomly chosen elements «i, . . . , 
of Z p , there will exist a polynomial a{x ) G A which has ‘small’ absolute value 
modulo p (less than H ) at all the points an, ... , We remark that a similar 
(and more general) lemma was used in the analysis of a polynomial approxima- 
tion algorithm m ■ Note that the lemma does not hold in general if we allow 
A to contain constant polynomials, since these polynomials may have constant 
coefficient smaller than H. 

Lemma 1. Fix a prime p, positive integers (n,t,H), and a non-empty set A 
of polynomials of degree at least 1 and at most t with coefficients in 7L p . Let 
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£(n,t,H,A ) C Zp denote the set of vectors a = (ai, . . . , a-/) £ 2p for which 
there exists a polynomial a € A such that ||a(ai)||t j p < H for all i = 1 ,n. 
The size of the set £(n, t, H . A) is upper bounded as follows: 

#£(n,t,H,A) < # 1 - (2#«)". 

Proof. Suppose that a = (au , . . . , oA) G 2” is such that there exists a polyno- 
mial a £ A such that 


H^IU.p <H for i=l,...,n. (1) 

It follows that there exist n integers r %, . . . , such that, for each i = 1, . . . , n, 
we have a(a,) — r, = 0 (mod p) with r ? ; < H and hence a* is a zero of the 
polynomial g/x) = a(x) — r* over 2 P . But for each i, g t is a polynomial of degree 
at least 1 and at most t over 2 p and hence has at most t zeros in 2 P . So for 
each possible value for (n, . . . , r n ) G (-H, H) n and a £ A, there are at most t n 
‘bad’ values for a = (au, . . . , a^) in (2 p ) n such that flU holds. Using the fact 
that there are less than (2 H) n possible values for (n, . . . , r~) and less than #A 
possible values for a, the claimed bound follows. □ 


3 Definition of Changeable-Threshold Secret-Sharing 
Schemes 

We will use the following definition of a threshold secret-sharing scheme, which 
is a slight modification of the definition in m- 

Definition 2 (Threshold Scheme). A (t, ri) -threshold secret-sharing scheme 
TSS = (GC, D, C) consists of three efficient algorithms: 

1. GC (Public Parameter Generation): Takes as input a security parameter k £ 
A f and returns a string x £ X of public parameters. 

2. D (Dealer Setup): Takes as input a security /public parameter pair ( k , x ) and 
a secret s from the secret space S(k,x) C {0, l} fc+1 and returns a list of 
n shares s = (si,...,s n ), where Sj is in the ith share space S/k,x) for 
i = 1, . . . , n. We denote by 

D feiX (.,.) :S(k,x) x7l(k,x)^Si(k r x) x---xS n (k,x) 

the mapping induced by algorithm D (here lZ(k, x) denotes the space of ran- 
dom inputs to the probabilistic algorithm D). 

3. C (Share Combiner): Takes as input a security /public parameter pair ( k,x ) 
and any subset s/ = (sj : i £ I) of t out of the n shares, and returns a 
recovered secret s £ S(k,x). (here I denotes a subset of [n] of size ffl = t). 
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The correctness and security properties of a (f, n)-threshold secret-sharing 
scheme can be quantified by the following definitions, which are modifications 
of those in [T7] . 

Definition 3 (Correctness, Security). A ( t,n ) threshold secret- sharing 
scheme TSS = (GC, D, C) is said to be: 

1. <S C -correct: If the secret recovery fails for a ’bad’ set of public parameters of 
probability pf at most S c . Precisely, pf is the probability (over x = GC(fc) E 
X) that there exist ( s,r ) E S(k,x ) x 7 Z(k,x) and I C [n] with #/ = t such 
that Ck, x {si) f=s, where s = Dfc iX (s,r) and s / = f {sj : i E I}. 

We say that TSS is asymptotically correct if, for any S > 0, there exists 
ko E J\f such that TSS is 6-correct for all k > ko. 

2. (t s , 6 S , e s ) -secure with respect to the secret probability distribution Pk, x on 
S[k, x): If, with probability at least 1 — 6 S over the choice of public parameters 
x = GC(£;), the worst-case secret entropy loss for any t s observed shares is 
at most e s , that is 


I Ws/)l = f \H(s E S(k,x)) - H(s E S(k,x) |s/)| < e s , 

for all s € Si(k,x ) x • • • X S n (k,x ) and I C [n\ with ffl < t s . We say that 
TSS is asymptotically t s -secure with respect to Pk. x if, for any 6 > 0 and 
e > 0 there exists ko E Af such that TSS is ( t s , S, e ■ k)-secure with respect to 
Pk,x for all k > ko ■ 

The following definition of the Threshold Changeability without dealer assis- 
tance for a secret sharing scheme is a modification of the definition in [15] . 

Definition 4 (Threshold-Changeability). A (t, n) -threshold secret- sharing 
scheme TSS = (GC, D, C) is called threshold-changeable to t' with 6 c - correctness 
and ( t s ,S s ,e s )-security with respect to secret distribution Pk, x , if there exist n 
efficient subshare generation algorithms Hj : Si(x, k ) — > %(x, k ) for i = 1, . . . , n, 
and an efficient subshare combiner algorithm C such that the modified ( t',n )- 
threshold scheme TSS' = (GC, D', C'), with modified shares 

D 'k, x (s,r) d = (Hi(si), . . . , H„(s„)) eTx{k,x) x ■■■T n (k,x), 

where (%,..., s n ) = D fciX (s; r), is S c -correct and ( t s , <5 S , e s ) -secure with respect to 
Pk,x. TSS is called asymptotically threshold-changeable to (t s ,t') with respect to 
Pk, x if there exist algorithms Hi : Si(k, x) — » %(k, x) (i = 1, . . . , n) and C' such 
that the {t’ ,n) -threshold scheme TSS' defined above is asymptotically correct and 
asymptotically t s -secure with respect to Pk, x - 

The idea captured by the above definition is that the change of threshold 
from t to t' is implemented by getting each shareholder to replace his original 
share Sj by the subshare Hi(sj) output by the subshare generation algorithm Hj 
(the original share s t is then discarded). 
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4 Threshold-Changeability for Shamir Secret-Sharing 

4.1 The Standard Shamir Scheme 

The standard Shamir (t, n ) -threshold secret sharing scheme is defined as follows. 

Scheme ShaTSS = (GC, D, C): Shamir (t, n)-Threshold Secret-Sharing 

1. GC(fc) (Public Parameter Generation): 

(a) Pick a (not necessarily random) prime p € [2 fc , 2 fe+1 ] with p > n. 

(b) Pick uniformly at random n distinct non-zero elements a = 
(«i, . . . , a n ) 6 D((Z*) n ). Return x = (p, a). 

2. Dfc )a; (s, a) (Dealer Setup): To share secret s e Z p using t — 1 uniformly 
random elements a = (ai, . . . , o t _i) e Z* _1 , build the polynomial a sa (x) = 
s+aix+d 2 X 2 +. . . +a t _ix t -1 € Z p [x; t— 1]. The ith share is s* = a(aj) mod p 
for i = 1, . . . 

3. Ck, x (si) (Share Combiner): To combine shares sj = (s* : * £ I) for some I C 
[n] with #/ = t, compute by Lagrange interpolation the unique polynomial 
b e Z p [x; t — 1] such that Ha,) = s* (mod p) for all i 6 I. The recovered 
secret is s = 6(0) mod p. 


4.2 Threshold- Changing Algorithms 

Our threshold-changing subshare generation and combiner algorithms to change 
the (f, n)-threshold scheme ShaTSS = (GC, D,C) into a {f , n)-tlireshold scheme 
ShaTSS' = (GC, D', C') are defined as follows. Note that the subshare combiner 
algorithm uses an efficient CVP approximation algorithm Acvp with || • H,*,- 
approximation factor 7 cvp- We define Tcvp = log(p ycvp + 1) ) (if we use the 
Babai poly-time CVP algorithm, we have /cvp < 1 — 0.5(t' + t+ log(f' + t))). 

Scheme ShaTSS': Changing Threshold to t' > t 

1. Hj(sj) (f th Subshare Generation): To transform share € Z p of original 
(t, n)-threshold scheme into subshare t, e of desired (t' , n) -threshold 
scheme ( t ' > t) the itli shareholder does the following (for allf = 1 ,n): 

(a) Determine noise bound H which guarantees 6 c -correctness (typically, we 
set 8 C = k _t ): 

i. Set H = max([_p a /2j , 1) with 

ii. o=l— > 0 (noise bitlength fraction) and 

iii. S F = ^ (log (6“ 1/t 'nf) + r CV p + l) • 

(b) Compute U = o, • s* + r, mod p for a uniformly random integer r, with 
\n\<H. 

2- C'fc )X (tj) (Subshare Combiner): To combine subshares t / = (t, : i € I) for 
some I = {*[1], . . . ,i[t']} with #1 = t' (and guaranteed 6 c -correctness) , do 
the following: 
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(a) Build the following ( t ' + 1) x (t' + 1) matrix Msha{oci , H,p), whose rows 
form a basis for a full-rank lattice Csha{ a h H,p) in Q 4 +t : 




/ P 

0 

... 0 0 0 

.. 0 \ 




0 

P 

... 0 0 0 

.. 0 




0 

0 

. . . p 0 0 

.. 0 



M Sh a(ai,H,p ) = 

a m 

ba; 

• • • H/p 0 

.. 0 




a di] 

a i[2] 

0 H /P 

.. 0 




\ a ![i] 

a hh 

■ ■ ■ a qt'] 0 0 

• • ■ H/p) 


Here H = \p a / 2j,a = 1 

1-lHfe 

W 

, 6 f 

= (ft (log^ 1 /*' 
i) e z 4 ' +t . 

nt ) + r CV p + l) • 

Define t' = {fjm , . . . , tm 

], 0, 0, . 

...,C 



Run 

CVP Approx. 

alg. 

Acvp on lattice 

£sha{oii,H,p) 

given 

by Ms ha {ai,H,p) with 

target vector 

t'. Let 

C = 

(ci,- 

• , ct’, ct’+i, ■ ■ ■ , Cf+t) € Q 4 +t 

denote the output vector returned 


by Ac vp. approximating the closest vector in Csha to t'. 
(d) Compute the recovered secret s = (p/H) ■ c t >+i mod p. 


Remark 1. The reason for multiplying the shares s, by a* before adding the noise 
rj, is that otherwise, the secret may not be uniquely recoverable from the noisy 
subshares (indeed, a(a,) + r* = a(cq) + 1 + (n — 1), and typically |r* — 1| < If, 
so secrets s and s + 1 would be indistinguishable). 


Remark 2. It is not difficult to see that our method of adding a ‘small’ random 
noise integer r, : with r, : | < H to the share multiple a, t ■ S{ modulo p, is essentially 
equivalent (in the sense of information on the secret) to passing the residues 
cq • Si mod p through a deterministic function which chops off the log(2JJ) ss 
(1 — 1 /(t'/t))-k least-significant bits of the fc-bit residues a* • s* mod p, and this 
also yields shorter subshares than in our method above. However, since reducing 
the length of the original shares is not our main goal, we have chosen to present 
our scheme as above since it slightly simplifies our scheme and its analysis. 
Similar results can be obtained, however, for the ‘deterministic’ approach of 
chopping off least-significant bits. 

Remark 3. Some special variants of the Shamir scheme use special values for 
the points a*, such as a* = i for i = 1, . . . , n, to which the above method does 
not apply, because of its reliance on the random choice of the cq’s. However, it 
turns out that our method can be modified to work even for these special Shamir 
variants. The idea is to make up for the loss of randomness in the cq’s by getting 
the shareholders to multiply their shares by additional random integers (say 
Bi G ~%- p ) prior to adding the random noise r t . The B t 's are then sent along to 
the combiner with the noisy subshares. We do not analyze this variant of our 
scheme in this paper. 
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4.3 Correctness 

The following theorem shows that the choice of the parameter 8 f used in our 
threshold changing algorithm is sufficient to guarantee the ^-correctness of our 
scheme for all sufficiently large security parameters. 

Theorem 4 (Correctness). The scheme ShaTSS 7 (with parameter choice 8 C = 
k~ l ) is asymptotically correct. Concretely, for any choice of parameter 8 C (0 < 
8 C < 1), the ( t',n ) scheme ShaTSS 7 is 8 c -correct for all security parameters k 
satisfying the inequality k > k' Q , where 

K = {jjfCCf) (log + r CV p + 2) • 

Proof. Fix a subshare subset I C [n] with ffl = t! . We know by construction of 
lattice C-shaipi)-, that the dealer’s secret polynomial a s , a (a:) = s + a^x + ...+■ 
a t - ix t_1 G 2 p [cc; t — 1] gives rise to the lattice vector 

a 7 = (a^a^a^i]) - h p, ..., a^ja^Ca^]) - k v p , (^H), ~^H , . . . , ^ l -H ), 
which is “close” to the target vector 

= (ck*[i] ) - hp + rj[i], . . . , - k t 'P + r »[ t '],0,0, ... ,0), 

where kj = ^. a »M a ( ni «bl) +r »M j ^ 2 for all j = 1, . . . ,t 7 . In particular we have, 
using |rjy]| < H for all j = 1 ..... f 7 , that ||a 7 — t 7 ^ < H. Consequently, since 
Acvp is a CVP approximation algorithm with || . || oo approximation factor 7 cvp > 
its output lattice vector c will also be “close” to the target vector, namely we 
have ||c — t'Hoo < 7 cvp • H. Applying the triangle inequality, we conclude that 
the lattice vector z = c — a 7 satisfies 

IMIoo = llc-a'lloo < (7 cvp + 1)H. (2) 

Now, either ^c[t 7 + l] = j)a 7 [£ 7 + l] = s (mod p) in which case the combiner 
succeeds to recover secret s, or otherwise we have the ‘bad’ case that 

+ 1] = jj C [t 7 + 1] - jja'[t' + 1] ^0 (mod p). (3) 

Hence, for fixed 7, the combiner succeeds except for a fraction 81 of ‘bad’ 
choices of 07 G _D(( Z*) 4 '), for which Csha(pi) contains a ‘short’ and ’bad’ 
vector z satisfying 0 and 0. To upper bound 81 , consider the polynomial 
f(x) — + l]x + • • • + j|z[t 7 + t\x l . Note that, since z G Csha, we have 

/(«*$) = z[j] (mod p) and hence \\f(cti[j])\\L,p < (7 cvp + 1 )H for all j G [t 1 ] 
using (0). Also, f{x) mod p has zero constant coefficient and degree at least 1 
and at most t over 1L P using (0). Applying Lemma Q] (with parameters n=t',t = 
t,H = 2 r ° vp H, #A < //) we conclude that such a ‘bad’ polynomial / exists 
for at most a fraction 81 < p* (210)*' /#D ((%.*)*') of 07 G D((2*) ^, ), for each 
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fixed I. Hence, the probability 8 that a uniformly chosen a £ D((Z.*) n ) is ‘bad’ 
for some I C [n] with #/ = t' is upper bounded as 


/ (?) p ‘( 2 my 

- #D«z;n ’ 


and a straightforward calculation (see full paper) shows that the right-hand side 
of (H| is upper bounded by 8 C for all k > ^7/^1 ) (log^ 1 ^ nt) + Tcvp + 2^ . 
This completes the proof. □ 


4.4 Security 

The concrete security of our scheme is given by the following result. It shows that, 
for fixed ( t',n ) and with parameter choice 8 C = fc -t , the ( t',n ) scheme ShaTSS' 
leaks at most fraction e s /k = 0(log k/k) = o(l) of the entropy of the secret to 
an attacker observing less than t! — {t'/t) subshares (for all except a fraction 
8 S < 8 C = o(l) of public parameters, and assuming the security parameter k is 
sufficiently large). 

Theorem 5 (Security). The scheme ShaTSS' (with parameter choice 8 C = 
fc -t ) is asymptotically Int(t' — {t' /t))- secure with respect to the uniform secret 
distribution on 1L V . Concretely, for any parameter choice 8 C > 0, the ( t',n ) 
scheme ShaTSS' is (t s ,8 s ,e s )-secure with: 

t ~ {t'/t ) 

1 + (log (8~ x/t 'nt) + r CV p + l) ’ 

log(2<5- 1 (”)) 

8 S = 8 C , e s = {(3 + 7)(t s +t) +t s logt + 1, /3 = f +t _{ ’ 

for all security parameters k > ko, where, letting m = t s + t+ 1 and k' 0 as defined 
in Theorem [^J 

k 0 = max ^k' 0 + y (/? + log t + 3) , (/3 + 4)m 2 + 5t s mlogm^ . 


Proof. (Sketch) Fix an observed subshare subset I C [n] with #/ = t s . Assuming 
the secret is uniformly distributed on Z p it is easy to show (see full paper) that 
the conditional probability Pk, x (s\si) of the secret taking the value s € Z p given 
that the observed sub-share vector takes the value s j is given by: 


Pk,x(s\si) 


#S s , p (ai,t,p , ff.sj) 
P,i(a/,f,p, H, s/)’ 


(5) 


where, for any integers s"> 0 and p> 1, we define the set 


S^aj,t ) p,ff,s / ) d = {a G Zplxjt- 1] : \\a ib] a(a iU] ) - s ib] \\ L>p < HVj G [t s ] 

and a(0) = s (mod p)}. 
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We will derive a probabilistic lower bound on #Sq,i and upper bound on 
#S StP which both hold for all except a fraction 81 < 6 a / ( " ) of ‘bad’ choices 
for ai G D((Z*) ts ) assuming k > ko (with t s , 8 S and ko defined in the theorem 
statement). We then apply these bounds to © to get a bound Pk.x(s\si) < 2 €a /p 
for all s (with e s defined in the theorem statement) so that for fixed I, entropy 
loss is bounded as L kx (sj) < e s , except for fraction 8j of oq G D((Z.*) ta ). It 
then follows that L kx {sj) < e s for all I C [n] with ffl = t s except for a fraction 
8 < (t)8i < 8 S of a G D((Z*)") assuming that k > ko, which proves the 
theorem. 

Reduction to Lattice Point Counting. It remains to derive the desired probabilis- 
tic upper and lower bounds on The following lemma shows that #<S~~ is 

equal to the number of points of a certain lattice Csha (closely related to the lat- 
tice used in our subshare combiner algoritm) contained in a ( t s + 1 ) -dimensional 
box of side length 2 H, centered on a certain non-lattice vector sj. 

Lemma 2. Fix positive integers ( t,t s ,p,H,p ) such that p > 2 H andp is a di- 
visor ofp. Let s G Z.p on = (aqij, . . . , a i[ts] ) G 7L n v and sj = (s^ij, . . . , s i[ts] ) G 
.Define £sh a (<xi,t,p,H,p ) as the full-rank lattice in Qf B+t with basis consist- 
ing of the rows of the matrix 


M Sh a(oii,t,p , H,p) = 


/ p 

0 

... 0 

0 

0 .. 

.. 0 \ 

0 

p 

... 0 

0 

0 .. 

.. 0 

0 

0 

... p 

0 

0 ., 

.. 0 

POti[ 1] 

fail 2] 

■ • • miits 

] 2 H/{p/p) 

0 ., 

.. 0 

a i[i] 

a i[2] 

••• a \ts] 

0 

2 H/p . 

.. 0 

v Q ‘[ 1 ] 

a l[2] 

a hs] 

0 

0 .. 

•2 H/p) 


and define the vector s/ G 




Then the sizes of the following two sets are equal: 


I, . . . ,H{1 - 


tP^arCiP, H, Sl ) = {a G Z p [*;t- 1] : Ha* bl a(a ib1 ) - s ib] || L , p < FVj G [t„] 

and a(0) = s' (mod p)}, 


Vxfat’t’P’Hfo) = {v € C sh a(.ai,t,p,H,p) : 


-S/lloo <H}. 


Finding a Lower Bound on #Vo,i- Lower bounding the number o,i 
of points of the lattice Csho. in a symmetric box T Sl (H) = f {v G Q ts+1 : 
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1 1 v — s'i- 1 1 oo < H} centered on vector s/ seems a difficult ‘non-homogenous’ prob- 
lem because sj is in general not a lattice vector. But by ‘rounding’ sj to a nearby 
lattice vector (with rounding error e = ||s^ — S/||oo)) we reduce the problem to 
two simpler problems: (1) The ‘homogenous’ problem of lower bounding the num- 
ber of lattice points in an origin- centered box T 0 = (v G Q t,+t : Hv)^ < H—e}, 
and (2) Upper bounding the largest Minkowski minimum A t a +t(£she) of the lat- 
tice. This general reduction is stated precisely as follows. 


Lemma 3. For any full-rank lattice C, in IR", vector s G IR" , and H > 0, we 
have 


#{v G £ : ||v - s;|U < tf} > #{v G £ : < H - e}, 


where e= ~ • A „(£). 

To solve the ‘homogenous’ counting problem (1) above we directly apply 
the Blichfeldt-Corput theorem (Theorem [5] in Sec. H]) . To solve the problem (2) 
above of upper bounding \t a +t{£-Sha )> we apply Minkowski’s “second theorem” 
(Theorem |3] in Sec. HJ) to reduce this problem further to the problem of lower 
bounding the first Minkowski minimum X\ (C-sho)- Namely, since XjfLsha) > 
Ai(Tsho) for all i G [t s ], then Minkowski’s second theorem gives X ta +t(£sha) < 
^(^s^tf+t-i • Finally, to lower bound Xi(Csha) (he. the infinity norm of the 
shortest non-zero vector in Csha ), we use a probabilistic argument based on the 
algebraic counting lemmaQ] (similar to the argument used in proving Theorem 0} , 
to obtain the following result. 


Lemma 4. Fix positive integers ( t,t s ,p,H,p ) and a positive real number [3, such 
that p > max(2H,2t s ) is prime and p G {1 ,p}. For each ay G D((Z*)* S ), let 
£sha(oti,P) denote the lattice in Q ts+t with basis matrix Msha{&i,P) defined 
in Lemma 0 and let C.' Sha {ai) denote the lattice in Q ts+t_1 with basis matrix 
M's ha { a i) obtained from Msha{oti,p) by removing the (t s + l)th row and column. 
In the case p 1, if 


1 < 2-[ /3+3+i t^] det {£s h a(ati, l)}** < H 
then, for at least a fraction 1 — 2~^ ts+i ^ of oti G D((2*) ts ) we have 


AiO Cshaiou,!)) > 2-f^+^ldet {£ Sha (ai,l)}^ . 


In the case p = p, if 

! < 2-^ +3+ ^l det^^^aj))**! < H 
then, for at least a fraction 1 — 2~^ ts+t ~ 1 '> of ai G D((2*)* s ) we have 
Ai &>/)) > A iOWa/.p)) > 2-^+ 3 +^l det(£^ a (a f ))TO. 
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Combining the above results (for (s, p) = (0, 1)) we obtain the desired lower 
bound on #Vo,i- 

Finding an Upper Bound on #V SiP . We first reduce the point counting prob- 
lem in jCsha(cti,p) to a point counting problem in the lower-dimensional lat- 
tice C Sha {ai ) defined in Lemma |U This is possible because all the vectors of 
C-Sha{oLi,p) in the desired box have their (t s + l)th coordinate equal to 0. 

Lemma 5. Let Csha{oii,p) C Q‘* +t and C.' Sha {ai) C Q* s+t_1 be the lattices 
defined in LemmaU J letsi be the vector in Q ts+t defined in Lemma 0 and let 
be the vector in obtained from s / by removing the ( t s + 1 )th coordinate. 

Then #V S>P < #Vf p , where V s , p = f {v G £sha(o!i,p) : ||v — s/||oo < H} and 
K', P = {v G C' sha {ai) : ||v - s' |U < H}. 

By comparing the total volume of the #V S , P disjoint boxes of sidelength Ai (C Sha ) 
centered on the lattice points in T \ ( H ) = f {v G Q ta+t_1 : ||v — Sj||oo < H}, to 
the volume of T~, ( H ) = f {v G Q* a+t_1 : ||v — s' / || (X ) < H + Ai(£' sfea )/2} which 
contains those disjoint boxes, we reduce the problem of upper bounding #V S . P 
to the problem of lower bounding the A i{L' Sha ). This general reduction can be 
stated as follows. 

Lemma 6. For any lattice C in IR", vector s G IR n , and H > 0, we have 

#{vG£:||v-s|| 00 <if}< ;[^y + l] n - 

Now we apply the probabilistic lower bound on Ai (T' Sha ) from Lemma H] in 
Lemma [6] (with (s,p) = ( s,p )) to get the desired upper bound on #V S>P . 

After some straightforward calculation (see full paper), we find that the prob- 
abilistic lower and upper bounds on obtained above hold for all except a 

fraction 6i < <5 s /(") of ‘bad’ choices for ai G D((2*) ts ) assuming k > ko (with 
t s , S s and k 0 defined in the theorem statement), and plugging the bounds in 
© gives the desired bound Pfc, x (s|sj) < 2 €a /p for all s (with e s defined in the 
theorem statement). This completes the proof sketch. □ 

An immediate consequence of the above results is the following. 

Corollary 1. For any ( t,n ) and if > t, the standard Shamir (t,n) -threshold 
secret- sharing scheme ShaTSS is asymptotically threshold- changeable to 
(Int(t' —t'/tfit') with respect to the uniform secret distribution. 

5 Conclusions 

We presented a new cryptographic application of lattice reduction techniques to 
achieve threshold-changeability for the standard Shamir ( t , n)-threshold scheme. 
We proved concrete bounds on the correctness and security of our method, mak- 
ing use of fundamental results from lattice theory in our analysis. 
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Abstract. We study the class of masking based domain extenders for 
UOWHFs. Our first contribution is to show that any correct mask- 
ing based domain extender for UOWHF which invokes the compression 
UOWHF s times must use at least [log 2 s] masks. As a consequence, we 
obtain the key expansion optimality of several known algorithms among 
the class of all masking based domain extending algorithms. Our second 
contribution is to present a new parallel domain extender for UOWHF. 
The new algorithm achieves asymptotically optimal speed-up over the 
sequential algorithm and the key expansion is almost everywhere opti- 
mal, i.e., it is optimal for almost all possible number of invocations of 
the compression UOWHF. Our algorithm compares favourably with all 
previously known masking based domain extending algorithms. 

Keywords: UOWHF, domain extender, parallel algorithm. 


1 Introduction 

A universal one-way hash function (UOWHF) is a function family {hkjkeic with 
hk : {0, 1}" — » {0, l} m , for which the following task of the adversary is compu- 
tationally infeasible: the adversary chooses an n-bit string x, is then given a k 
chosen uniformly at random from K. and has to find a x' such that x /=x' and 
hk{x) = hk(x r ). The notion of UOWHF was introduced in [9]. 

Intuitively, a UOWHF is a weaker primitive than a collision resistant hash 
function (CRHF), since the adversary has to commit to the string x before 
knowing the actual hash function hk for which a collision has to be found. In 
fact, Simon na has shown that there is an oracle relative to which UOWHFs 
exist but CRHFs do not exist. Further, as pointed out in [1], the birthday paradox 
does not apply to the UOWHF and hence the message digest can be smaller. 
Thus a construction for UOWHF may be faster than a construction for CRHF. 

There is a second and perhaps a more important reason to prefer UOWHF 
over CRHF. A protocol built using a UOWHF maybe “more” secure than a 
protocol built using CRHF. The intuitive reason being that even if it is possible 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 3329, pp. 187- 12001 2004. 
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to find a collision for a hash function, it might still be difficult to find a collision 
for it when considered as a UOWHF. This situation is nicely summed up in [I]: 
“Ask less of a hash function and it is less likely to disappoint!” 

The important paper by Bellare and Rogaway [T] provides the foundation for 
the recent studies on UOWHFs. They introduce the notion of domain extender 
for UOWHF; show that the classical Merkle-Damgard algorithm does not work 
for UOWHFs; provide several new constructions for UOWHF domain extenders 
and finally provide a secure digital signature scheme based on UOWHF in the 
hash-then-sign paradigm. 

The study in pQ shows that extending the domain usually requires an asso- 
ciated increase in key length. One of the major new ideas behind their domain 
extending algorithm is “masking” the outputs of intermediate invocations by 
random strings. This idea of masking based algorithms have been later pur- 
sued by several authors [TTl 151 [T51[T31 15117]. We would like to point out that pQ 
also presents other (i.e., non-masking type) techniques for domain extension. 
However, the key expansion for these techniques is more than the masking type 
techniques. Consequently, subsequent work, including the current one, have con- 
centrated only on masking type domain extenders. 

Our Contributions: The contribution of this paper is twofold. 

We start by formalizing the class A of all masking based domain extend- 
ing algorithms. This class includes all known efficient domain extending algo- 
rithms [HJ[5J[T5J[]U[SJ[7]. ^ Ily mas ki n g based algorithm in A proceeds by XOR- 
ing the output of any intermediate invocation of the compression UOWHF by a 
fixed length bit string called a mask. 

Suppose {hk}k£)c, hk : {0, 1}" — > {0, l} m is a compression UOWHF whose 
domain is to be extended. Further, suppose that an algorithm in A makes s 
invocations of hk (for some k £ /C) and uses a total of p masks. In Proposition [TJ 
we show that the length of any string in the extended domain is n+(s— l)(n— m). 
The resulting amount of key expansion is pm and hence the key expansion is 
totally determined by the number of masks. 

Our main result on class A is to obtain a necessary condition for any algo- 
rithm in A to be a correct domain extending algorithm. Using this necessary 
condition, we obtain a non-trivial lower bound on the number of masks used 
by any correct algorithm in A More precisely, in Theorem [lj we show that 
p > [~ log ‘2 s~| ■ Based on this lower bound, we define the masking efficiency, ME 
of an algorithm which uses p masks and makes s invocations of the compression 
UOWHF to be ME = p— [~log 2 s] . In the case ME = 0, we say that the algorithm 
achieves optimal masking. Our lower bound immediately shows the masking op- 
timality of the sequential algorithm of Shoup m and the parallel algorithms 

of m\- 

The basic unit of operation of a domain extending algorithm is one invocation 
of the compression UOWHF. The number of operations made by any sequential 
algorithm is equal to the number of invocations of the compression UOWHF. On 
the other hand, in a parallel algorithm, several invocations of the compression 
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UOWHF is done in parallel and thus the number of parallel rounds will be 
lower. Suppose an algorithm makes s invocations of the compression UOWHF 
and uses N p processors to complete the computation in N r rounds. Since there 
are s invocations and N p processors, at least fs/JV p ] parallel rounds will be 
required and hence N r > [s/N p ]. We define the parellelism efficiency, PE to be 
equal to s/N r . In general, PE < N p and in the case PE = N p we say that the 
algorithm achieves optimal parallelism. 

Our second contribution is to obtain a parallel domain extending algorithm. 
The basic idea of the algorithm is to divide the input message into several parts, 
hash each part separately and then combine the different parts using a binary 
tree. This idea has already been suggested for collision resistant hash functions 
by Damgard in [2]. Our contribution is to add a suitable masking strategy. The 
result is a simple and efficient parallel domain extending algorithm for UOWHF. 
The masking efficiency M E is almost always zero and in very few cases it is one. 
Hence we say that the masking efficiency of our algorithm is almost always 
optimal. Further, the parallelism efficiency PE is asymptotically optimal. Thus 
our algorithm provides a satisfactory parallel domain extender for UOWHF and 
to a certain extent completes the line of research on obtaining efficient domain 
extenders for UOWHFs which was started in pQ. 

Related Work: We have already mentioned that UOWHF was introduced by 
Naor and Yung [S] and the important work done by Bellare and Rogaway Q]. 
There are several direct constructions of UOWHFs based on general assump- 
tions mm- However, as noted in [I] these are not very efficient. Subsequent 
to the work in [I], Shoup m described a nice domain extending algorithm 
which is a modification of the Merkle-Damgard construction. Shoup’s algorithm 
is a sequential algorithm and Mironov [6] proved that the algorithm achieves 
minimal key length expansion among all sequential masking based domain ex- 
tending algorithms. (As opposed to this, our lower bound shows that Shoup’s 
algorithm is optimal among all masking based domain extending algorithms.) 
Later work [13j[8j|3j[12j[7] have provided different parallel constructions of do- 
main extending algorithms with varying trade-off between degree of parallelism 
and key length expansion. These are summarized in Tables Q] and [2] 

We note that none of the previous constructions simultaneously achieve op- 
timal parallelism and optimal key expansion. (In [7], it is claimed that their 
algorithm achieves optimal parallelism. This claim is not correct: In [7], s = 2 T 
and the number of parallel rounds is N r = T + 1. This requires N p = 2 T_1 and 
hence PE ss N p / log, 2 N p : as explained above, for optimal parallelism we should 
have PE = N p .) 

Note that the algorithms in [TJEIIIEIITIEI] can also be executed with a fixed 
number of processors by a level-by-level simulation of the large binary tree. 
However, this simulation will require storing the results of all the invocations 
at one level and hence will push up the memory requirement. In contrast, for 
our algorithm, the required number of buffers is exactly equal to the number of 
processors. 
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Table 1. Comparison of masking efficiency. Here s is the number of invocations of the 
compression UOWHF 


| construction! [T] [13] | [8] 

ns] 

QUEIE] 

ours | 

ME s=s log 2 s « log 2 log 2 s 0(log* s) 

const | 

o | 

0 or 1 T 


f: the value is almost always 0. 


Table 2. Comparison of parallelism efficiency. Here N p is the number of processors 


| construction 

[HEMEI 

0 

\m^\ 

PE 


« l const. 



In (3, a sufficient condition for the correctness of any algorithm in A is 
presented. Essentially, this condition states that, if, for any subtree, there is at 
least one mask which occurs exactly once in that subtree, then the construction 
is correct. In contrast, our necessary condition states that for any correct con- 
struction, for any subtree, there must be at least one mask which occurs an odd 
number of times. Though these two combinatorial conditions are close, they are 
not the same and they have not yet been proved to be equivalent. In fact, it is 
also possible that they cannot be proved to be equivalent. 

Our necessary condition yields a tight lower bound on the number of masks, 
whereas the sufficient condition in [7] is used to verify the correctness of some 
previous constructions. However, it is not easy to apply the sufficient condition 
of [7] to prove the correctness of the construction in m and the construction 
presented here. On the other hand, for small examples, it is possible to verify 
that both the construction in m and the one presented here satisfy the sufficient 
condition of [7]. Thus our necessary condition and the sufficient condition of [7] 
are actually different and are of separate interest. It could be an interesting 
research problem to obtain a single necessary and sufficient condition for correct 
domain extension for any algorithm in A. 

The rest of the paper is organized as follows. In Section [TJ we describe the 
necessary preliminaries. In Section [3J we describe the formal model for masking 
based domain extenders and study its properties. In this section, we also obtain 
the necessary condition and the lower bound on the number of masks. The new 
construction of a parallel domain extending algorithm is described in Section 01 
Finally, Section [5] concludes the paper. Due to lack of space, most of the proofs 
are omitted. These can be found in the full version of the paper and in the 
technical report m- 

2 Preliminaries 

All logarithms in this paper are to the base 2. The notation x G r A denotes 
the (uniformly at) random choice of the element x from the set A. Also A 
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denotes the empty string. By an (n, m) function / we will mean a function 
/ : {0, 1}" — > {0, l} m . A formal definition for UOWHF is given in [9]. In this pa- 
per we will be interested in “securely” extending the domain of a given UOWHF. 
Our proof technique will essentially be a reduction. We formalize this as a re- 
duction between two suitably defined problems. 

Let F = {hkjkeic be a keyed family of hash functions, where each hk is an 
(n,m) function, with n > m. Consider the following adversarial game 5(F) for 
the family F. 

1. Adversary chooses an x G {0, l} n . 

2. Adversary is given a k which is chosen uniformly at random from K. 

3. Adversary has to find x' such that x /=x' and h k {x) = hk{x'). 

The problem 5(F)-UOWHF for the family F is to win the game 5(F). 

A strategy A for the adversary runs in two stages. In the first stage A guess , 
the adversary finds the x to which he has to commit in Step 1. It also produces 
some auxiliary state information state. In the second stage A find (a;, k. state), the 
adversary either finds a x' which provides a collision for hk or it reports fail- 
ure. Both A guess and k, state) are probabilistic algorithms. The success 

probability of the strategy is measured over the random choices made by A guess 
and k, state) and the random choice of k in Step 2 of the game. We say 

that A is an (e, g)-strategy for 5(F )-UOWHF if the success probability of A is 
at least e and it invokes some hash function from the family F at most q times. 
Informally, we say that F is a UOWHF if there is no “good” winning strategy 
for the game 5(F). 

In this paper, we are interested in extending the domain of a UOWHF. Let 
F = {hkjkeic, where each h k is an (n, to) function. For % > 1, let rij = n + (i — 
l)(n — m). Define F 0 = F and for i > 0, define F* = {H p .} p . e -p., where each 
H Pi is an (n, , to) function. The family F, is built from the family F. In fact, as 
shown in Proposition |T] a function in F, is built using exactly i invocations of 
some function in F. 

We consider the problem 5(Fj)-UOWHF. We say that the adversary has an 
(e, g)-strategy for 5(Fj)-UOWHF if there is a strategy B for the adversary with 
probability of success at least e and which invokes some hash function from 
the family F at most q times. Note that Fj is built using F and hence while 
studying strategies for 5(Fj) we are interested in the number of invocations of 
hash functions from the family F. 

The correctness of our construction will essentially be a Turing reduction. We 
will show that if there is an (e, <?)-strategy for 5(Fj), then there is an (<q , qi)- 
strategy for Fj, where ei is not “significantly” less than e and q\ is not “signif- 
icantly” more than q. In fact, we will have e:j = e/i and qi = q + 2 i. Since F, 
invokes a hash function from F a total of i times, we “tolerate” a reduction in 
success probability by a factor of 1/i. (This is also true for other constructions 
such as in [T].) The intuitive interpretation of the reduction is that if F is a 
UOWHF then so is Fj for each i> 1. 

The key length for the base hash family F is [log |/C|]. On the other hand, 
the key length for the family Fj is flog | T^j | "| . Thus increasing the size of the 
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input from n bits to rq bits results in an increase of the key size by an amount 

rioginn-riogirii. 

3 Lower Bound on Key Expansion 

In this section, we consider the problem of minimising the key expansion while 
securely extending the domain of a UOWHF. More precisely, we are interested in 
obtaining a lower bound on key length expansion. Obtaining a complete answer 
to this problem is in general difficult. Thus we adopt a simpler approach to 
the problem. We fix a class of possible domain extending algorithms and obtain 
a lower bound on key expansion for any algorithm in this class. (Note that 
in computer science, this is the usual approach for proving lower bounds on 
algorithmic problems. For example, the lower bound of 0(n log n) for sorting n 
elements is obtained for the class of all comparison based algorithms.) 

The usefulness of our lower bound depends on the class of algorithms that 
we consider. The class that we consider consists of all masking based domain 
extending algorithms. (We make this more precise later.) All previously known 
masking based algorithms [lJ[T3J[T3j[T2j[8l[3l|7] belong to this class. We consider 
this to be ample evidence for the usefulness of our lower bound. However, we 
would like to point out that our lower bound does not hold for any domain ex- 
tending algorithm. Thus it might be possible to achieve lower key expansions. 
However, any such algorithm must adopt an approach which is different from 
masking based algorithms. One possible approach could be to develop the tech- 
nique of using separate keys for the compression functions (see |U). 

Let F = {hk}k e ic, where each h k is an (n, rn) function. We are interested in 
the class A of masking based domain extension algorithms. We do not want the 
algorithm to be dependent on the structure of the UOWHF; in fact it should 
work for all UOWHF’s which can “fit” into the structure of the algorithm. Any 
algorithm A £ A behaves in the following manner. 

1. It invokes some function ft^gFa finite number of times. 

2. The outputs of all but one invocation of hk() is masked by XORing with 
an m-bit string selected from the set {po, . . . , p p -i}. 

3. The invocations of hk() whose outputs are masked are called intermediate 
invocations and the invocation whose output is not masked is called the 
final invocation. 

4. The entire output of any intermediate invocation is fed into the input of 
exactly one separate invocation of h k ()- 

5. Each bit of the message x is fed into exactly one invocation of h k ()- 

6. The output of the final invocation is the output of A. 

We emphasize that all previously known masking based algorithms pram 
Q21E1I3JE] belong to A. In the following we make a general study of any algorithm 
in A, with particular emphasis on obtaining a lower bound on key expansion 
made by any algorithm in A. 
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Proposition 1. Let A e A. be such that A invokes hk() a total of s times. 
Then the length of the message which is hashed is equal to n + (s — l)(n — m) . 

Thus the number of invocations of hk() and the parameters n and m deter- 
mine the length of the message to be hashed irrespective of the actual structure 
of the algorithm. Hence any algorithm A £ A. which invokes hk() a total of s 
times defines a family F (4 U = {H^ A ’ s ^} peV , where V = (0, i}l fe l+ m P and each 
Hp A,s ' > is an (n + (n — rn)(s — 1). m) function. The structure of any algorithm 
A G A. which makes s invocations of hk() is described by a labelled directed 
graph Df = (V s , E s ,ip s ), where 

1. V s = {ui, . . . , u s }, i.e., there is a node for each invocation of hk(). 

2. ( Vi,Vj ) £ E s if and only if the output of the ith invocation is fed into the 
input of the jth invocation. 

3. ip s is a map ip : E s —> {/x 0 , . . . , /U p _i}, where u j 2 ) = g,j if the output 

of the -tli invocation of hk() is masked using fj,j . 

The nodes corresponding to the intermediate invocations are called interme- 
diate nodes and the node corresponding to the final node is called the final node. 
Without loss of generality we assume the final node to be v s . Nodes with inde- 
gree zero are called leaf nodes and the others are called internal nodes. Define 
6(Df) = max{indeg(v) : v £ V s }. We call S(D^) to be the fan-in of algorithm A 
for s invocations. 

Proposition 2. The outdegree of any intermediate node in Df is 1 and the 
outdegree of the final node is 0. Hence there are exactly ( s — 1) arcs in Df. 
Consequently, Df is a rooted directed tree where the final node is the root of Df. 

Proposition 3. If 6 = 8(D £■), then n > 8m. 

Thus an algorithm A with fan-in 8 cannot be used with all UOWHFs. The 
value of fan-in places a restriction on the values of n and m. However, given 
this restriction the actual structure of Df does not depend on the particular 
family F. 

Let T be a non-trivial subtree of Df. Denote by vec,/, (T) the p-tuple 
(num w (T) mod 2, . . . , num Mp _ 1 (T) mod 2), 

where num Pi (T) is the number of times the mask /j, occurs in the tree T. We say 
that Df is null-free if vec ip{T) /= (Q. . . ,0) for each non-trivial subtree of Df. 

We now turn to the task of obtaining a lower bound on key expansion made 
by any algorithm A in A.. This consists of two tasks. Firstly, we show that for any 
“correct UOWHF preserving domain extender” A which invokes some function 
from the compression UOWHF exactly s times, the DAG Df must be null-free. 
This translates the problem into a combinatorial one. Our second task is to use 
use this combinatorial property to obtain the required lower bound. 

The intuitive idea behind the first part is as follows. Given Df and a family F' 
with suitable parameters, we construct a family F such that if F' is a UOWHF, 
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then so is F. Then we extend the domain of F using Df to obtain the family 
F( a > s ) and show that if Df is not null-free then it is possible to exhibit a collision 
for every function in F( a,s ). Now we argue as follows. If F' is a UOWHF and 
A is correct for s invocations, then F( a,s ) must also be a UOWHF and hence 
D A must be null-free. This intuitive argument is now formalized in terms of 
reductions. 

Let A £ A and Df be the DAG corresponding to s invocations of the 
compression family by A. We set 6 = 6(Df). Let F' = {h' k }ke/c where each h! 
is an (n, m') function with K = {0, 1}^ , to = ml + K and n = 6m + 5+1. For 
2 € {0, 1}" write 


* = «l,l|l«l,2lKl||*2,2|| • • ■ IK1IK2II ■ ■ • \\ZS,l\\ Z S,2\\y\\ b 

where \z it i| = to, \zi$\ = K for 1 < i < 6 , \y\ — 6 and b £ {0,1}. We write 

y = y(z) and b = b(z) to show the dependence of y and b on 2. Given 0 £ {0, 1}", 

define KLst = {+l, 2 > 22, 2 j ^3,2, • ■ • , z s, 2 }- Given z £ {0,1}” and k £ JC, define a 
Boolean function (j)(z,k) to be true (T) if and only if k = 0. u . eS w for some 
0 /=S C Kl_st(+). We define the family of functions F = {hkjkeic, where each 
hk is an (n, to) function in the following manner. 

hk(z) = h' k (z)\\k if b = 1 and (j>(z,k) = F; 

= /i^zjjjo^ if b = 0, y = O' 5 and <f>(z, k) = F; 

= h' k (z)\\Sy if b = 0,y /= (9 and 1 j>(z,k) = F; 

= l m (j){z, k) = T. 

Here y = y(z) and S y = ® Vi= iz^ 2, i.e., the XOR’s of the 2^2’ s for which the 
ith bit of y is 1. 

Proposition 4. Suppose there is an (e,q)- strategy for 5(F). Then there is an 
(e - q) -strategy for 5(F') . 

Intuitively, this means that if F' is a UOWHF, then so is F. In the next result 
we show that if Df is not null-free, then it is possible to exhibit a collision for 
each function in F^ 4 ’ 8 ). 

Lemma 1. Let A £ A. and F be defined as in 0. For s > 0, let F( a,s ) 
be the family obtained by extending the domain of F using D f. If Df is not 
null- free, then it is possible to define two strings x,x' such that x f=x ’ and 
H { p A ’ s \x) = Hp A,s \x') for any H^ A ' s) £ F( a - s ), 

We now translate Lemma Q] into a lower bound on the number of masks. 

Definition 1. Let I\ = (U 1; Ej) and T 2 = (V 2 , E 2 ) be two subtrees of Dff . We 
denote by T\AT 2 the subtree of Df induced by the set of arcs E\AE 2 , where 
E\AE 2 is the symmetric difference between Ei and E 2 . 

Definition 2. Let T be a family of non-trivial subsets of Df such that for any 
Ti,T 2 £ T , the tree T\AT 2 is also a non-trivial subtree of Df. We call T a 
connected family of Df . 
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Lemma 2. Let Df be null-free and let T be a connected family of Df . Then 

1. For any Tgf, vec ^(T) /= (Q. . . ,0). 

2. For any Tx,T 2 6 T, vec,/,(Ti) /=vec^,(T 2 ). 

Consequently, 2 P — 1 > \F\ or equivalently p > [~log 2 (|.F| + 1)], where p is the 
number of masks used by A for s invocations. 

Lemma [2] provides a lower bound on the number of masks in terms of sizes 
of connected families. Thus the task is to find a connected family of maximum 
size in Df. We show the existence of a connected family of size (s — 1) in Df. 
For each intermediate node v G Df, let P v be the path from v to the final node 
of Df. Define T = {P v : v is an intermediate node in Df}. It is easy to check 
that T is a connected family of size (s — 1). Hence we have the following result. 
Theorem 1. Let s > 0 and A £ A. be correct for s invocations. Then the 
number of masks required by A is at least [log 2 s] ■ 

The bound in Theorem Q] is tight since Shoup’s algorithm pT] meets this 
bound with equality. This also shows that Shoup’s algorithm is optimal for the 
class A . Also we would like to point out that the lower bound of Theorem [T] 
can be improved for particular algorithms. 

Lemma 3. Suppose Df is the full binary tree on s = 2 t — 1 nodes. If t = 2, 
there is a connected family of size 3 in Df and for t > 3, there is a connected 
family of size 5 x 2 —2 in Df. Consequently, p> 2 for t = 2 and p>t + l 
for t> 3. 

4 New Construction 

For t > 0, let T t be the binary tree defined as T t = (V t = [Pq, . . . , P 2 t_ 2 }, A t ), 
where A t = {(P 2 j + i,Pj), (-P 2j + 2 , _P 7 ) : 0 < j < 2 t ~ 1 — 2}. The underlying digraph 
for our algorithm is a binary tree with sequential paths terminating at the leaf 
nodes of the tree. We define a digraph Gt,i which consists of the full binary tree 
T t alongwith a total of i nodes on the sequential paths. The precise definition of 
Qt,i = A t>i ) is 

V t ,i =V t U{Q 0 ,...,Qi-i} ) 

A t ,i = A t U {(Qj,P 2t - i +j _0 : 0 < j < 2 t ~ 1 - 1} \ (2) 

The total number of nodes in Gt,i is equal to 2* — 1 +i, where 2* — 1 nodes 
are in the binary tree part and i nodes axe in the sequential part. We define 
parameters r t ,i and s tl i (or simply r and s ) in the following manner: If i = 0, 
then r = s = 0; if i > 0, then r and s are defined by the equation: 

i = r2 t_1 + s (3) 

where s is a unique integer from the set {1, . . . , 2 t ~ 1 }. For i > 0, we can write 
t=(r + l)xs + (2 t_1 — s)r. Thus in Gt,i there are s sequential paths of length 
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(r + 1) each and these terminate on the left most s leaf nodes of T t . There are 
also (2 t_1 — s ) sequential paths of length r each and these terminate on the other 
(2 t_1 — s) leaf nodes of %. Figured] shows £? 4 i i 9 . 

We define pt.i or (simply p) to be the maximum length (counting only Q 
nodes) of a path from a Q-node to a P-node. Hence p = 0 if i = 0 and p = r + 1 
if * > 0. 

When * = 0, Qtj is simply the full binary tree T t and when t = 1, Qt.i is a 
dipath of length r + 1. These are the two extreme cases - one leading to a full 
binary tree and the other leading to a single dipath. In practical applications, 
t will be fixed and there will be “long” dipaths terminating on the leaf nodes 
of T t . For implementation purpose, the number of processors required is 2 t ~ 1 . 
Hence for practical applications, the value of t < 5. 

Remark: The idea of breaking a message into parts, hashing them indepen- 
dently and finally combining the outputs is present in Damgard [2] in the context 
of collision resistant hash functions. The current construction can be seen as a 
development of the “UOWHF version” of this idea. 

4.1 Notation 

We define a few notation for future reference. 

1. t is the number of levels in the binary tree T t . 

2. * is the total number of nodes in the sequential part of the algorithm. 

3. r and s are as defined in ([3]). 

4. p = 0 if i = 0 and p = r + lifi>0. 

5. iV = 2 t — 1 + i is the total number of nodes in Q t ,i- 

6. For U £ V^j, define nodenum(f7) = j if U = Pj and 
nodenum(f7) = j + 2* — 1 if U = Qj. 

7. For U £ Vt,i, we say that U is a P-node (resp. Q-node) if U = Pj 
(resp. U = Qj) for some j. 

For U e V t ,i , we define indeg(P) (resp. outdeg(P)) to be the indegree (resp. 
outdegree) of U. Note that other than P 0 each node U has outdeg(f/) = 1. Thus 
for each node U /=Pq there is a unique out neighbour. 

The concept of level is defined in the following manner. There are L = p + t 
levels in Q t i and the level number of each node is defined as follows. 

level (P,) = L - 1 - j t if 2 ^ - 1 < j < 2 jl+1 - 2 and 0 < j x < t- 1; ) 

level(Qj) = p - ji - 1 if ji2 t_1 < j < (ji + l)2 t_1 - 1 and 0 < j x < r - 1; &4) 
level (Qj) =0 if r2 t ~ 1 <j< r2 t ~ 1 + s. J 

Note that if p = 0, there are no Q-nodes and hence the level numbers of 
Q-nodes are not defined. The root node of % has the highest level. Nodes with 
indegree zero can be at levels zero and one. Let U £ Vt,i and j = nodenum(P): 
If 0 < j < 2 4_1 — 2 then we define lchild(17) = P 2 j+i and rchild(P) = P 2 j +2 ; if 
2 t_1 — 1 < j < N — 1, then we define predecessor of U in the following manner: 
pred(CZ) = Qj +2 t-i if 2 t_1 — 1 < j < 2* _1 + i — 2; \ 

= NULL if 2 t_1 + i— l<j<iV — 1; j 


(5) 
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For a node U, pred(P) = NULL implies that the indegree of U is zero. 

4.2 Mask Assignment Algorithm 

There are two disjoint sets of masks {ao, . . . , cq_i } and [Po, ■ • • , fit- 2} where 
l = [log(p + t) ] . The mask assignment 

: A tji -> {o;o,---,a;_i}U{/3o,...,A-2}- 
is a function from the set of arcs of Gt,i to the set of masks. The definition of ip 
is as follows: Let (U, V) £ A tii with level (U) = j — 1 and level (V) = j for some 
j 

• If ((U is a Q-node) or (U is a P-node and U = lchild(U))), 
then tf(U, V) = a v (j)- 

• If ( U is a P-node and U = rchild(U)) then V ) = 

Here v{ j) is defined to be the non negative integer j\ such that 2 :n \j and 
2 J1 + ' /| j. Also for the convenience of notation we write p(U, V) instead of 
ip((U, f/)). The mask assignment for ^4,19 is shown in Figure [T] 


4.3 Optimality of Mask Assignment 

The total number of masks used is equal to t - 1 + [log(p + <)] . The total 
number of nodes in Gt,i is equal to N = 2* — 1 + i. Using Theorem [TJ at least 
= [log(2 4 — 1 + *)] masks are required by any algorithm in class A. Our 
algorithm requires lZ t l = t — 1 + [log(p + t)] masks. Define V t i = TZ t l — C t l . 
We study T> tji . 


Proposition 5. 

D tji = 0 if i = 0 and t = 1; 'j 

= [log t] — 1 if i = 0 and t > 1; > (6) 

= [log(r + 1 + t)l - [log (r + 2 + |^}' | ifi> 0. J 

Furthermore, V t p = 0 if and only if either t = 1; or (t = 2 and i = 0); or 

2-i — 1 — [(s — 1) /2 t_1 ] < r < 2 j+1 — t—1 for some j > 0. 


For t = 1, the mask assignment algorithm reduces to the mask assignment 
algorithm of Shoup [H] and for i = 0, the mask assignment algorithm reduces 
to the mask assignment algorithm of Sarkar m- Hence we concentrate on the 
case t > 1 and i > 0. For practical parallel implementation, the value of t will 
determine the number of processors and will be fixed whereas the value of i can 
grow in an unbounded manner. 

Suppose 2 T_1 < t — 1 < 2 T . For j > 0, define two intervals of integers in the 
following manner: 


h = (2 T+j - 1 

Jj = {2 r +i +1 - 


t, 2 T +J+ 1 -t + 1, 


^l,...,2 T +J+ 1 -t-l};\ 

. , 2 T+J+1 — 2 T JgE=r] }• J 


( 7 ) 


Clearly, \Ij\ = 2 T+ - J — t + l+ [(s - l)/2* r | , \.Jj \ = t — 1 — [(*• — l)/2' and 

\Ij\ + \Jj\ = 2 r+j - 
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Fig. 1. Example of mask assignment for t = 4 and i = 19 


Theorem 2. Suppose i> 0, 2 T 1 < t — 1 < 2 T and /or j > 0, Ij and Jj are as 
defined in [7 1 Then V t/L = 0 if r G Ij; and T> tji = 1 if r & Jj. 

From Theorem [7J it follows that for / > r, in any interval 2 J + 1 < r < 2 J+1 , 
there are exactly t — 1 — [~(s — 1) /2 t_1 ] points where the algorithm is suboptimal 
with respect to the lower bound. Moreover, at these points it requires exactly 
one extra mask over the lower bound. In any practical parallel implementation, 
the value of t will be fixed, whereas the value of r will grow. In such a situation, 
the ratio ^j(t— 1 — [ (s — l)/2 t-1 ~|) approaches zero very fast and hence we can 
say that for t > 2, the algorithm achieves optimal key length expansion almost 
everywhere. (Note that for t = 1, the algorithm reduces to Shoup’s algorithm 
and hence achieves optimal key length expansion.) 

4.4 Computation of Message Digest 

Let {hk}ke> c> where each hk is an (n, m) function, be the compression UOWHF 
whose domain is to be extended. For t > 1, we require n > 2m. The nodes 
of Gt,i represent the invocations of hk- Thus hk is invoked a total of N times. 
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The output of Pq is provided as output digest, whereas the outputs of all the 
other nodes are used as inputs to other invocations as defined by the arcs of 
Gt, i- Using Proposition 1 of [T2] we obtain the following: Suppose a message x is 
hashed using Gt.i and the compression UOWHF {hkjkeic, where each hk is an 
(n, m) function. Then \x\ = N(n — m) + to. 

Thus {hk}keic is extended to {Hp’^} p£ -p where each Hp’^ is an (N(n — m) + 
m, m) frmction and 


P= fc||ao||...||aj_i||^o||...||/3i_ 2 . 


The message x of length N(n — rn) + m has to be formatted into small 
substrings and provided as input to the different invocations of hk- Write x = 
xo|| . . . | |rcjv— 1 , where the lengths of the x 3 ’s are as follows. 



The substring Xj is provided as input to node U with nodenum(f/) = j and 
the m-bit output of U is denoted by Zj. The outputs zi,... ,zn - i are masked 
using the a and (3 masks to obtain m-bit strings yi, , un-i in the following 
manner. 


yj = Zj ® ^(U, V) if nodenum(U) = j. 


(9) 


The inputs to the invocations of hk are formed from the x’s and the y’s in 
the following manner. There axe N invocations whose inputs are denoted by 
wo, ■ ■ ■ ,wn - i and are defined as follows. 


Wj = Xj \\y 2 j +1 \\y 2j + 2 ifl<j<2 i 2 3 4 5 6 - 1 -2; ) 

= Xj\\yj + 2 t-i if r > 0 and 2*” 1 - 1 <j< 2*” 1 +i- 2; \ (10) 

= Xj if 2 t ~ 1 + i — 1 < j < 2* + i — 2. J 


Note that the length of each Wj is n and hence we can invoke hk on Wj for all 
j £ {0, . . . , N — 1}. For any node U € V*,, we define x(U),y(U) and w(U) to be 
the x, y and w strings associated to the node U as defined respectively in ((8j) , © 
and (fTOjl . Similarly the output of node U will be denoted by z(U). 

Now we are ready to describe the digest computation algorithm. Most of the 
work has already been done, so that the description of the algorithm becomes 
simple. Suppose the compression UOWHF is {hk}keic- We describe the digest 
computation of Hp’ 1 ^ ( x ) . 

Algorithm to compute ij( i >*)(x) 

1. for j = 0 to L — 1 do 

2. for all U with level (U) = j do in parallel 

3. compute z(U) = hk(w(U )); 

4. end do; 

5. end do; 

6. return zq. 
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5 Conclusion 

In this paper, we have formalized the model for masking based domain extending 
algorithms. Using this formal model, we obtained a lower bound on the minimum 
amount of key expansion required by any masking based algorithm. Our second 
contribution has been to develop a simple and efficient parallel domain extender. 
The key expansion of our algorithm is almost everywhere optimal whereas the 
efficiency of parallelism is asymptotically optimal. 
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Abstract. Universal One-Way Hash Functions (UOWHFs) are families 
of cryptographic hash functions for which first a target input is chosen 
and subsequently a key which selects a member from the family. Their 
main security property is that it should be hard to find a second input 
that collides with the target input. This paper generalizes the concept 
of UOWHFs to UOWHFs of order r. We demonstrate that it is possible 
to build UOWHFs with much shorter keys than existing constructions 
from fixed-size UOWHFs of order r. UOWHFs of order r can be used 
both in the linear (r + l)-round Merkle-Damgard construction and in a 
tree construction. 

Keywords: Hash Function, Collision Resistant Hash Function (CRHF), 
Universal One-Way Hash Function (UOWHF), Higher Order Universal 
One-Way Hash Function. 


1 Introduction 

Since the introduction of the notion of UOWHFs by Naor and Yung in 1989 [5], 
it is widely believed that UOWHFs form an attractive alternative to CRHFs 
(Collision Resistant Hash Functions). The main requirement for a UOWHF is 
that it is hard to find a second preimage. First a challenge input is selected by 
the opponent, subsequently a key is chosen which selects a member of the class 
of functions and only after this choice the opponent has to produce a second 
preimage with the same hash value (for this key) as the challenge input. This 
should be contrasted to CRHFs, where first a key is selected and subsequently a 
two colliding inputs need to be found; due to the birthday paradox, a black box 
approach for a CRHF with an n-bit result takes on average about 2"/ 2 queries. 
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Simon m has demonstrated that a UOWHF is a strictly weaker concept than 
a CRHF. UOWHFs can replace CRHFs in many applications; even for digital 
signatures this is feasible, but it should be noted that one becomes vulnerable 
to attacks by the signers (who can cheat and choose the key before the target 
message). The concept of UOWHFs has been generalized by Zheng et al. [h2] 
and by Mironov [4]. 

A standard approach to construct hash functions that take input strings of 
arbitrary length is to start from a compression function that compresses input 
strings of fixed length. For CRHFs, the Merkle-Damgard construction is a widely 
used and efficient method meg. Both authors showed independently that it is 
sufficient for the hash function to be collision resistant that the compression 
function is. Damgard also proposed a tree construction. Naor and Yung showed 
that it is possible in principle to build UOWHFs by composition J5J. However, 
Bellare and Rogaway showed that even if the compression function is a UOWHF, 
a 2-round Merkle-Damgard iteration of this function may not be a UOWHF. 

Subsequently, provably secure constructions have been developed based on 
compression functions at the cost of an increase in key length. Bellare and Rog- 
away PQ propose two types of constructions. 

— The first type has a linear structure; two variants of the Merkle-Damgard 
construction were shown to be secure: the basic linear hash and the XOR 
linear hash. Later, Shoup improved the XOR linear hash construction. He 
shows that if one has a fixed size UOWHF which maps n bits to m bits (with 
n > m), one can construct a UOWHF that can hash messages of bit-length 
2 t {m — n) + m bits to m using a key of bit-length t ■ m and 2* applications 
of the compression function. Mironov has proved that this construction is 
optimal in terms of key size among linear constructions [1] . 

— The second type has a tree structure. Here the two constructions with a 
security proof are the basic tree hash and the XOR tree hash (they extend 
the work of [5]). XOR tree hash has subsequently been improved further, a.o. 
by Sarkar [7j[8] and by Lee et al. im. who reduce the key size and extend 
these structures to higher dimensional parallel constructions. 


1.1 Motivation 

The special UOWHF made by Bellare and Rogaway pQ loses its universal one- 
wayness when it is extended to 2-round Merkle-Damgard construction. This ex- 
ample motivated us to study general constructions that work for any UOWHF 
compression function. It means that the Merkle-Damgard construction cannot 
be used for extending a universal one-way compression function in general. How- 
ever, this property does not applied to all UOWHFs. The compression functions 
of certain UOWHFs may not lose their universal one-wayness until they are ex- 
tended to 3-round Merkle-Damgard construction. In this case, a 2-round Merkle- 
Damgard construction based on the compression function can be used as another 
compression function and so the key size of the whole scheme is reduced by a 
factor of 2. This lead to promising results, since an important goal of research 
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on constructions extending UOWHFs has been optimalization of the key size. 
We began with the Merkle-Damgard construction, but we found that the tree 
construction has the same problem as the Merkle-Damgard construction. 

Intuitively, a UOWHF which does not lose its universal one-wayness until 
it is extended to 3-round Merkle-Damgard construction is a slightly stronger 
primitive than Bellare-Rogaway’s special UOWHF. More generally, a UOWHF 
which does not lose its universal one-wayness until it is extended to more round 
Merkle-Damgard construction is stronger. So, we need new security notions to 
classify UOWHFs. 

1.2 Our Contribution 

We define the order of a UOWHF. We can classify UOWHFs according to the 
order. The classes of UOWHFs of same order form a chain between CRHF and 
UOWHF classes. 

We show in Theorem Q] that if a UOWHF has a higher order, a Merkle- 
Damgard construction with more rounds based on it becomes a UOWHF. Theo- 
rem [3] states that if a UOWHF has a higher order, a tree construction with more 
levels becomes a UOWHFs. Theorems [T] and [3] are our main results. They con- 
sider collisions of the same length only, since we want to use our Merkle-Damgard 
and tree constructions only as a compression function which plays the role of a 
building block in the known constructions. Theorems |2] and 0] are generalizations 
of Theorem 1 and 3 which are mainly of theoretical interest. 

1.3 Organization of This Paper 

This paper is organized as follows. Section 2 introduces our notation and defini- 
tions and presents the counterexample of Bellare and Rogaway. In Sect. 3, our 
new definition of higher order UOWHFs is introduced. Section 4 and 5 present 
respectively the Merkle-Damgard and the tree construction based on higher or- 
der UOWHFs. Some concluding remarks are made in Sect. 6. 

2 Preliminaries 

We will follow the notation and computation models in pQ. 

2.1 Notation 

We denote the concatenation of strings x and x' by x\\x' or xx' . E n is the set 
of all strings of bit-length n. We use the notation E™ instead of S nrn when we 
want to stress that each string consists of m blocks of bit-length n. The set of 
all strings whose lengths are multiple of n is denoted by U+. 

A hash function family is a function H : S k x S rn — > S c , where S k is the 
key space, S m is the message space, and S c is the set of hash values. We often 
need to change E m to describe different hash function families. 

We write x S n for choosing a string of n-bit length uniformly at random. 
For a string x, a; is its bit-length. When A is an algorithm, program or adversary, 
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A(x) — » y means that A gets an information of x to output y. When we want to 
address that A has no information to outputs y, we write A(null ) — > y with the 
null string null. 

We take the RAM (Random Access Machine) model of computation which is 
also used in [I], and measure the running time of a program with respect to that 
model. If H : E k x E rn — > E c is a hash function family, we let Tu indicate the 
worst-case time to compute H(K,x), in the underlying model of computation, 
when K £ E k and x £ E rn . 


2.2 Definitions of CRHF and UOWHF 

Recently, Rogaway and Shrimpton suggested seven simple and nice definitions 
of hash functions including CRHF and UOWHF [B], but we prefer to use some 
games to define our objects and to describe our work. 

Definition 1 (CRHF). A hash function family H : E k x E rn — *• E c , m > c, is 
(t, e)-CRHF if no adversary A wins in the following game with the probability e 
and within the time t: 

Game(CRHF,A,R) 

K^-E k 
A(K) -* (x,x’) 

A wins if x / and H(K,x) = H(K,x'). 

In the game of Definition [TJ the adversary gets the key K of H . This implies 
that the adversary knows everything about H(K. •) and so it can try any exper- 
iments until it produces its output within the time t. However, the behavior of 
the adversary is more restricted in Definition [2J 

Definition 2 (UOWHF). A hash function family H : E k x E m — * E c , m > c, 
is ( t , e)-UOWHF if no adversary A = (Ai, Af) wins in the following game with 
the probability e and within the time t: 

Game(UOWHF,A,R) 

Ai(null) — * (x, State) 

K *2- E k 

A 2 (K, x, State ) — » x' 

A = (Ai,A 2 ) wins if x / sd and H(K,x) = H(K,x'). 

In Definition [2j algorithm A\ outputs the target message x. The only infor- 
mation which the adversary has before producing the target message is H. State, 
the other output of Ai, is some extra state information which helps A 2 to find 
a collision. Algorithm A 2 outputs the sibling message x' on input (x, State). 

Strictly speaking, when we are given H : E k x E rn — > E c , we should call it a 
CRHF family or a UOWHF family, but for simplicity we often just call it CRHF 
or UOWHF. 
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3 Higher Order UOWHFs 

Let us revisit Definition [21 No access to any oracles is given to Ax- Ax outputs 
(x, State) with no information. So, random selection of K from K is independent 
of Ai’s behavior. Consequently, changing the order of steps 1 and 2 in the game 
doesn’t effect the success probability of the adversary. So, the following game is 
essentially equivalent to the game in Definition [2] 

Definition 3. A hash function family H : E k x E m — > E c ,m > c, is (t,s)- 
UOWHF if no adversary A = (Ax,A 2 ) wins in the following game with the 
probability e and within the time t: 

Game (U OWHF' , A, H) 

K <2- E k 

Ax(null) — * (x, State) 

A 2 (K, x, State) — » x' 

A = {Ax,A 2 ) wins if x / -d and H(K,x) = H{K,x'). 

However, unlike the game in Definition [2j we can add an oracle G H ( K A to 
the game in Definition [31 which gets a query x and returns y = H(K,x). We 
can then allow the adversary to access the oracle before he chooses the target 
message. Now we give the following definition. Let Q be a set of adaptive query- 
answer pairs associated with the oracle which is initialized to the empty 

set 0 in the game. 

Definition 4 (r-th Order UOWHF). A hash function family H : E k xS m — > 
E c ,m > c, is ( t,e)-UOWHF(r ) if no adversary A = (A\,A 2 ) wins in the follow- 
ing game with the probability e and within the time t: 

Game(UOWHF(r), A) 

K^-E k - Q^0 
if r > 0 do: 

for i = 1, ..., r do: 

Ax(Q) -> Xi 

yi ^ o H ( K ’ x ^ 

Q <- {{xi,Vi)} u Q 

Ax(Q) -»■ (x, State) 

A 2 (K, x, State) — > x' 

A = {Ax,A 2 ) wins if x / and H(K,x) = H{K,x'). 

Indeed, the hash function families which satisfy Definition [3] can be regarded 
as UOWHF(O) families. The relationships among Definitions [U (3J [3] and H] can 
be summarized as follows. 


— > E c ,m > c, be a hash function family. 


Proposition 1. Let H : E k X E r 

Then, 
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1. H is a (t,e)-UOWHF& H is a {t,e)-UOWHF( 0). 

2. For any r > 0, H is a ( t',e)-UOWHF(r + 1 ) ^ H is a ( t,e)-UOWHF(r ), 
where t = t' — 0(T H + m + c) . 

3. For any r > 0, H is a (t',e)-CRHF => H is a ( t,e)-UOWHF(r ), where 
t = t'~ G(r)(T H + m + c). 

Proof. The proofs of 1 and 2 are trivial. So, we only prove 3. Suppose that 
A = (A-i . A?) is an adversary for H in the UOWHF(r) sense. We use it to make 
the adversary B who works in Game(CRHF,B, H ) as follows. 

Game(CRHF,R, H) 

K^- E k 
B(K) do: 

0^0 
if r > 0 do: 

for i = 1, ..., r do: 

A l (Q)^x i 
Vi H(K,xi) 

Q <-{(*«!/<)} UQ 

A\ (Q) — * ( x , State) 

Az (K, x, State) — > x' 
output ( x,x ') 

In the above game, B simulates 0 H(h] ' 1 for A±. Since B just outputs a 
collision which A found, the probability that B wins the game is same as A. The 
running time of B is at most t + 0{r){Tn +m + c). □ 

We claim that H is not a UOWHF(l) in Bellare and Rogaway’s example [1]. 
If the adversary asks any query x and get the answer y = H(K,x), then he 
would obtain the key K and can make a collision easily. 

4 Merkle-Damgard Construction Based on Higher Order 
UOWHF 

Suppose we have a hash function family H : E k x E c+m — ► E c , where m is 
a positive integer. The Merkle-Damgard construction of H with variable initial 
value gives a hash function family MD[L/] : E k x (E c x Eff) — * E c . For each 
key K £ E k and any message x = xqX\...x ti , where xo G E c and x* G E rn for 
i = 1, ..., n, MD[fL] is defined as follows. 

Algorithm MD[U](R', x) 
n <— (|x| — c)/m 
Vo <- 

for i = 1, ..., n do: 

Vi ^jc(y<-i||*<) 

return y n 
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If MD[U] only takes (c + nm)-bit messages for a fixed n, it would always 
have n rounds. In that case we use the notation MD„ [H] instead of MD [H] . 
In the following theorem, we say that if If is a UOWHF(r), the (r + l)-round 
MD r+ i[H] is a UOWHF. 


X\ X2 Xs 



K K K 


Fig. 1 . 3-round Merkle-Damgard construction MD,3[/7] 


Theorem 1. Let H : S k x Z c+m S c be a {t' ,e')-UOWHF{r). Then, MD r+ i 
[H] : S k x E c+rm ^ Z c is a ( 1 t,e)-UOWHF , where e = (r + l)e' and t = 
t' -G(r)(T H +m + c). 

Proof. Let x, x ' £ jjc+(r+i)m a collision for MD r+ i[F](ff, •). We observe that 
there exists an index j £ {!,... ,r + l} such that 


MD [H] (K, xqXj ■ ■ ■ Xj) = MD [H] (K, a/ 0 *i • • • a£) 
MD[H](K,x 0 x 1 ---x j . 1 )\\x j / = Mm^(K,x' 0 x' j ---x' j _ 1 )\\x' j . (1) 

We will exploit this below. 

Assume that A = (A-i , A 2 ) is an adversary who breaks MD r _|_i [If] with in- 
puts of equal-length in the UOWHF sense. We use it to make the adversary 
B = (B 1 ,B 2 ) who works in the Game (UOWHF (r),I?, H) as follows. 

Game(UOWHF(r),5, H) 

K U fc ; Q 0 

if r > 0 do: 

for j = 1, ..., r do: 

B^Q) do: 

if j = 1 do: 

Ai(null) — ► {x, State a) 

Vo x Q 

query y 0 \\ Xl to O h ^ k ^ 

if j > 1 do: 

query yj-i\\Xj to O h{k A 

Vj <- o H ( K w- ill*i) 

Q ^ {(yj-i\\xj,yj)}uQ 
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Bt(Q) do: 



output (?/*_ ! 1 1 x i , State B ) 

B 2 (K, yi_i | \xi, States) do: 

A 2 (K, x, State a) — > x' 
y l t _ 1 ^MV[H}(K,x > 0 x , 1 ---x' i _ 1 ) 
output y'i-xWx'i 

The adversary B works in the game as follows. When j = 1, Q is empty and 
Bi runs A\ to obtain (x. State a) where x = x,qXi ■ ■ ■ x r+ \. Then B\ sets yo to 
xo and sends a query yo\\xi to the oracle O h< - k, '\ When j / = TQ is nonempty 
and B\ sends a query yj-i \ \xj to the oracle O h ( k, '\ After collecting r adaptive 
query-answer pairs, Bi selects i £ {l,...,r + 1} at random, and then outputs 
yi_i\\xi and States = (i,x, StateA) as the target message and an additional 
state information for B 2 , respectively. On input (K, | \xi, States), B 2 runs 

A 2 by giving ( K , x, StateA)- Once A 2 outputs its sibling message x', B 2 computes 
y'_, and outputs y'_ 1 ||a: , i as its sibling message. 

Now we must bound the probability that | \x i ,y' i _ l | \x'f) is a collision for 
H(K, •) in the game. Note that i was chosen at random, so if (x, x') is a collision 
for MD r+1 [H\(K. •) then we have i = j with probability l/(r + 1), where j is 
the value of Equation ([TJ . So, s' > e/(r + 1). 

The running time of B is that of A plus the overhead. This overhead is 
0(r)(Tff + m+ c). The choice of t in the theorem statement makes all this at 
most t', from which we conclude the result. □ 

Assume that a domain V and a range 1Z are fixed. We regard the notion 
of UOWHF(r) as the class of all UOWHF(r). We also consider the class of all 
the hash functions which do not lose universal one-wayness (upto equal-length 
collisions) until they are extended to (r+l)-round Merkle-Damgard construction, 
UOW-MD(r). From Proposition [I] and Theorem [TJ it is easy to see that these 
classes forms two different chains between the classes CRHF and UOWHF with 
the same domain T> and the same range 1Z, and that for each integer r > 0, 
UOWHF(r) implies UOW-MD(r+l) (see Fig.®. 

We can generalize Theorem [1] to MD[iJ] taking inputs of variable length. We 
assume that the message is always padded such that its length is a multiple of 
m. There are many padding methods but we don’t mention any specific one. 
We use the notation (t,/ii,^,£)-UOWHF instead of (f, £)-UOWHF. pi is the 
bound on the length of the target message and ji 2 is the bound on the length of 
the sibling message. Note that the only restriction on fi 2 is that the algorithms 
on the sibling message should be computable in polynomial time. 

Theorem 2. Suppose H : S k x S c+rn —yS c bea (t 1 ,e')~ UO WHF(r) . Suppose 
yi — c and p 2 — c are multiples of m. Then, for p\ < c + (r + l)m and a proper 
p 2 , MD[JJ] : S k x (B c x E+) -► £ c is a (t, pn, /j, 2 ,e)- UOWHF, where e = a^e' 
and t = tl — <9(cr max ) ( Th +m + c) for cr min = min{(pi — c)/m, (p 2 — c)/m} and 
o-max = max{(/n - c)/m, (p 2 - c)/m}. 
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Fig. 2. Two chains between CRHF and UOWHF. Each arrow means the implication 



Proof. The proof is similar to that of Theorem [T] 


5 Tree Construction Based on Higher Order UOWHF 

If we are given a UOWHF family H : E k x S m — » E c and mis a multiple of 
c, we can extend it more efficiently by using a tree structure. If m = dc for a 
positive integer d, we can use a d-ary tree structure. Since a tree construction 
consists of parallel procedures, it can be more efficient than the Merkle-Damgard 
construction if multiple processors are available. 

Firstly, we define the parallel construction PA[H] on H. PA n [H] consists of 
n components PA„ [H]i, .... PA n [H] n . For K £ E k . each component function 
PA„[if]j is 

rA n {H] l (K,x) = l [ f‘- K ’ x ‘ ) *\l\z d c c 

That is, the domain of PA n [H}i(K, •) is E C U E dc , while the domain of H(K, •) 
is E c . 
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We assume that we are given x = x\ ■ ■ ■ x n for each aq £ S c LI S dc . For a key 
k £ B k , PA n [H](K,x) is defined as follows. 

Algorithm PA n [H](K,x) 

n <- l°gdc M 

for i = 1 , n do: 

Vi PA n [H]i(K,Xi) 
return yi\\---\\y n 

Now we define a tree construction TR[iJ] based on H . We begin with the 
message space S d . We denote the tree construction on H to hash only messages 
in >]£ as TR; [ H ] . For each key K £ E k and any message x e S d : , TR; [H] is 
defined according to: 

Algorithm TR i[H](K, x) 

Level[ 0] <— x 
for i= 1 , I do 

Level[i\ PA d i-i[H](K, Level[i - 1]) 
return Level[l] 

Write Level[ 0] = x as xo = xo, 1 X 0,2 ■ ■ • x 0td i where xo ,i e S c for * = 1, d l . 
Then, we can see TR; [H] ( K , x) is computed as follows. 

Level [0] = XqXq x d 

Level [1] = x\x\ xf 

Level [l — 1] = xj_ 1 ■ ■ ■ xf_ 1 
Level[l] = xj 

where x{ = H(K,x^ m x ( ^] V>d+2 ■ ■ ■ x^). 

The following theorem states that if H is a UOWHF(r) and r = (d l — 1)/ 
(d - 1), then TR; [H] is a UOWHF. 

Theorem 3. Let H : E k x S d ^ E c be a (t' ,e')-UOWHF{r) and r = (d l - 
d)/(d- 1). ThenTRtlH } : E k xSf -► S c is a ( t,e)-UOWHF , wheree= (r+l)e', 
and t' = t + Q(d l )(T H + dc). 

Proof. Assume that x,y £ E d is a collision for TR; [H](K, ■). We observe that 
there exist a £ { 1 . ...,1} and 0 £ {1, ...,d l ~ a } such that 

x i = Va 

4tl 1)d+1 H • • • \\xit, / ri-”i 1)d+1 ||- • • \\y p a d -v (2) 

We will exploit this below. 

Assume that A = (Ai, A 2 ) is an adversary who breaks TR; [H] with inputs of 
equal-length in the UOWHF sense. We use it to make the adversary B = (B-[ , B^) 
who works in Game(UOWHF(r),B, H) as follows. 
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Game(UOWHF(r),B, H) 

K *2- S k \Q^0 
if r > 0 do: 

for u = 1 , I — 1 do: 
for v = 1 , ..., d l ~ u do: 

B\(Q) do: 

if (u,v) = (1, 1) do: 

A\{null ) — > {x, State a) 
query xj|| • • • \\x d 0 to O h ^ 
if (u, v) / = (1) do: 

query .x^ 1 1)rf+1 || • • • \\x v u d _ x to O h (*••> 
x v 0 ff(K,4r^ + *iHK* i) 

Q - {(4-“i 1)d+1 ll • • • IKii,*5)} u Q 

Bi(Q) do: 

d^} 

output • ■ • \\%i-i, States} 

B 2 (K,x\ j _~ 1)d+1 1| • • -H^!, States ) do: 

A 2 (K, x, State a) — * y 
output ?/|i7 1)<i+1 |] • ■ • 11^! 

The adversary B works in the game as follows. When (u, v) = (1,1), Q is 
empty and B\ runs A\ to obtain (x, State a) where x = xJll ' ' ' \\ x o £ B d c . 
Then, Bi sends a query ccj 1 1 • • • \\x d to the oracle O h ( k, '\ When (u,v) / = ,(1), 
Q is nonempty. B\ sends a query • ■\\x'^f_i to the oracle O h ( k, '\ 

After collecting r adaptive query-answer pairs, Bi randomly selects i and j from 
{1,...,!} and {1, ..., d l ~ 1 }, respectively. The Bi outputs a:|i^^ d+1 || • • • as 

the target message and States = (*, j, x, State a) as an additional state informa- 
tion for B 2 . On the input (a:^ 1 ^ +1 || • ■ • \\x{ti, States), B 2 runs A 2 by giving 
(K, x, StateA)- Once A 2 outputs its sibling message x', B 2 computes and outputs 
y|^ 1)d+1 || • • • || yj^i as its sibling message. 

Now we must bound the probability that x£L"j^ <i+1 || • • • \\xj-i , • ■ • 

| \y 1 i d 1 is a collision for H(K. •). The number of possibilities for (i. j) is at most 
d° + • • • + d 1 - 1 = {d l - 1 )/(d - 1). Note that i and j were chosen randomly and 
independently, so if x, y is a collision for TR; [H] (K, •) then we have (i, j ) = (a, 0) 
with probability ( d — 1) / [d! — 1), where (a, fit) is the pair in Equation (HJ). So, 
e' > e{d - 1 )/(d l - 1). 

The running time of B is that of A plus the overhead, which is equal to 
G(d l )(T H + dc). □ 

The tree construction can hash the messages of variable lengths like the 
Merkle-Damgard construction. We assume that we are given a message x. When 
[log d ^1 = l, we pad x such that the length of the padded message x* is the 
smallest value larger than |x| of the form x* = (d l — qd + q)c for some integer 
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0 < q < d l 1 . Then, the number of applications of the underlying hash function 

is 1 + d + d 2 + ■ ■ ■ + d 1 - 1 — q = ~ 9- See Fig- HI El El and [7] for the case of 

1 = 2, d = 4. We denote the set of the padded messages in such way by 

S(c,d) = {x & £*\\x\ = (d l — qd+ q)c for some integers l > 0 and 
0 <q< d 1-1 } 

Now we generalize Theorem [3] 



Fig. 4. \x\/c = 16 = 4 2 


Fig. 5. |rc|/c = 13 = 4 2 - 1-4 + 1 



Fig. 6. \x\/c = 10 = 4 2 - 2- 4 + 2 


Fig. 7. \x\/c = Wm 4 2 - 3 • 4 + 3 


Theorem 4. Suppose H : S k x £* — > S c be a (t 1 ,e')-UOWHF{r). Suppose 
Pi = d li — qid + qi for i = 1,2. Then for p\ < c(r{d — 1) + d) and a proper 
P 2 , TR[ff] : S k x S(c,d) —y£ c isa ( t,e)-UOWHF , where e = a ^ r,e' and 
t! = t+ 0{a mayL )(T H + dc) for cr m in = min{ d ^~i — qi, / — 92} and (j max = 
maxj^ 1 - qi, ~ 92} • 

Proof. The proof is similar to that of Theorem |3] □ 

6 Conclusion 

We defined the order of a UOWHF family and showed how much the efficiency 
of known constructions for UOWHFs is improved by the notion of the order. 
Our main results are as follows. 
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— If the order of the underlying UOWHF H is r, then the (r+l)-round Merkle- 
Damgard construction MD r+1 [H] is also a UOWHF. If the resulting function 
MD r+ i[H] is used as a building block in existing constructions with linear 
structure, the key size can be reduced with at most a factor of (r + 1). 

— If the order of the underlying UOWHF H : S k x S d —> S c is r = d d Z\ ; 
then the /-level tree construction TRi[H] is also a UOWHF. If the resulting 
function TRi[H] is used as a building block in existing constructions with 
tree structure, the key size can be reduced with at most a factor of l. 
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Abstract. MD2 is an early hash function developed by Ron Rivest for 
RSA Security, that produces message digests of 128 bits. In this paper, 
we show that MD2 does not reach the ideal security level of 2 128 . We 
describe preimage attacks against the underlying compression function, 
the best of which has complexity of 2 73 . As a result, the full MD2 hash 
can be attacked in preimage with complexity of 2 104 . 


1 Introduction 

Cryptographic hash functions are an important primitive used in various situa- 
tions. The main fields of applications are message authentication codes, digital 
signatures, and therefore certificates. Hash functions are also used as a building 
tool in many protocols and advanced constructions. 

By definition, a hash function H is a function mapping an input message m 
of arbitrary length to an output h of fixed length (typically this length ranges 
from 128 to 512 bits) ^ _ #( m ) 

The main properties expected from a cryptographic hash function are: 

— Collision Resistance: it should be hard to find two inputs m and m' that 
map to the same output by H. 

— Second Preimage Resistance: for a given m, it should be hard to find a 
second input m! such that m and rrt! map to the same output by H. 

— Preimage Resistance: for a given challenge h, it should be hard to find 
an input m which maps to h by H. 

More can be found on the theory of hash functions in [9[[T0]. Most of the hash 
functions used in practice belong to the so-called “MD family” . This family of 
hash functions was initially developed by Ron Rivest for RSA Security. The first 
proposal was MD2 [7], an early, non-conventional, byte-oriented design. It was 
quickly followed by MD4 [11] and MD5 [12], two hash functions with a more 
modern, 32-bit-oriented design. Despite not being collision-resistant [3], MD4 
has inspired most modern hash functions designs, like the RIPEMD family or 
the SHA family. Over the last years, the effort on attacking hash functions has 
mostly concerned collision resistance [2-4, 15] , since this property is essential for 
many applications. However, few results have been reported regarding (second) 
preimage attacks for these hash functions (see m)- 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
© Springer- Verlag Berlin Heidelberg 2004 


), pp. 214- 12291 2004. 


The MD2 Hash Function Is Not One-Way 215 


In this paper, we focus on the MD2 hash function [7] . Despite being the oldest 
hash functions from its family, and despite using an old-fashioned architecture, 
MD2 is still used in several contexts. For instance, if we look at the recent PKCS 
#1 v2.1, a cryptographic standard from RSA Security [T7], the MD2 hash is still 
given as an example of one-way, collision-resistant hash function, while MD4 
has been removed, presumably because of Dobbertin’s collision attack (3]- In 
addition, it is precised that “MD2 (is) recommended only for compatibility with 
existing applications based on PKCS #1 vl.5”. The underlying explanation is 
that the use of MD2 was highly encouraged in the previous version from 1993 m 
where MD2 was recommended as a “conservative design”. This confidence in 
MD2 is not surprising because, despite being quite inefficient and based on an 
older design philosophy, MD2 has surprisingly well resisted to cryptanalysis. The 
only attack known is a collision attack against the compression function [H]. This 
attacks works with the correct IV, however it no longer works when a checksum 
is appended to the message, as imposed in the specifications [7]. For the full hash 
function, no attack is known. 

Consequently MD2 still appears in various applications and even some pro- 
posed standards [T]. However, the crucial security point regarding MD2 is now 
its use in public-key infrastructures. Many certificates have been generated with 
RSA-MD2 in the past and many of them are still widely used (like Verisign cer- 
tificates for instance). Actually, anyone can easily verify that recent versions of 
Windows are delivered with those MD2 certificates. Therefore millions of users 
are probably using MD2-based certificates on a regular basis. The security of 
certificates is a particular problem. Indeed, collision attacks do not threat the 
security of the scheme, because the input of the signature primitive (typically 
the usual primitive used with MD2 is the RSA signature) is fixed. An attacker 
needs to find a collision between two inputs of MD2, one of them being the 
data part of the certificate. If he succeeds, he will manage to forge a new valid 
certificate. Hence what is required here is exactly second preimage resistance of 
MD2. This is an important motivation to analyze the security of MD2 regard- 
ing preimage and second preimage attacks, which is the focus of this paper. We 
obtained interesting new results and theoretical attacks. Since our best attack 
against MD2 is more efficient than a naive guessing attack in 2 128 , MD2 can no 
longer be considered a secure one-way hash function. 

First, we describe briefly the MD2 algorithm. Then, we focus on the compres- 
sion function and describe several attacks. The best is a pseudo-preimage attack 
with complexity 2 73 . Finally, we show how to turn these attacks into an attack 
for the full hash, which is not straightforward because of the checksum bytes. 

2 The MD2 Hash Function 

2.1 Generalities 

The MD2 Message-Digest algorithm was developed in 1989 by Ron Rivest. The 
actual specifications can be found in RFC 1319 [JJ. This algorithm belongs, 
together with MD4 and MD5, to the family of hash functions developed by Ron 
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Rivest for RSA Security. However, compared to the other algorithms of the family 
(and to most actual hash functions) , MD2 has several interesting particularities 

— MD2 is a byte-oriented hash function. Indeed all instructions handle 8 
bits of data. While this was useful for old architectures, today’s processors 
can manipulate words of (at least) 32 bits. Consequently all modern hash 
functions use 32-bit instructions. This is the case of MD4, MD5 and also for 
the hash functions of the RIPEMD and SHA families. 

— MD2 uses a checksum of 128 bits computed from the whole message and 
appended as the last input block of the compression function. Hence MD2 
does not follow the Merkle-Damgard construction, contrarily to most actual 
hash functions. Consequently classical results [9] on how to turn collisions 
on the compression function to collisions for the whole hash function do not 
apply here. This is the reason why the collision attack described in [T3] does 
not extend to the full MD2 hash. 

— the compression function of MD2 has a different architecture from most 
modern hash functions. Indeed it does not look like a block cipher. Instead, 
a fixed “scrambling” function is iterated on a 384 bits long internal state. 
The initial state is derived linearly from a message block of length 128 bits 
and an intermediate hash of 128 bits. The final state is truncated to 128 bits. 
This function uses simple instructions like XOR and a nonlinear S-box. 

Therefore MD2 is a very early design of hash function and differs significantly 
from modern hash functions. In terms of efficiency, it compares quite bad to its 
challengers (mostly because of the byte-oriented structure). 

2.2 Description of MD2 

In this section, we describe more precisely the mechanisms used by the MD2 
hash function (see [7] for the full specifications). The general description of MD2 
is found in Figure [TJ 


message with padding 


M I C 



checksum 




Fig. 1. The MD2 Hash Function 


All blocks manipulated have length 128 bits. We refer to the blocks of the 
message by Mo, . . . , M n . The first step of MD2 is to append a padding to the 
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initial message, then to compute a checksum block (that we call C). This in- 
creases the length of the message by 1 block. Finally the compression function 
(referred to as F) is applied iteratively to produce the hash value. If we call H, 
the i-tli intermediate hash, 

H i+ 1 = ) 

The IV of the hash function is H 0 and is set by default to 0. 

The Compression Function. A precise representation of the compression 
function F is given in Figure [5J Each box in this figure contains one byte. F 
is decomposed into 3 matrices - denoted by A, B and C - with 16 columns and 
19 rows each. The first row of each matrix is initialized respectively with Hi, 
Mi and Hi ® M*. Then the rows of each matrix are computed recursively from 
top to bottom. The last rows of B and C are not used. The ’+’ symbol denotes 
addition modulo 256. 




Fig. 2. The Compression Function of MD2 

The computations are based on a function <f> from 16 bits to 8 bits. In the 
case of the matrix A, this can be described by the equations: 

A\ = (j){A t r 1 ,A t i _ 1 ) 

= A‘" 1 ®S(Ati) 

where S is a fixed S-box of size 8 bits. Equations for matrices B and C are 
exactly the same. This function cj) is represented in Figure |3] For the particular 
case i = 0, a byte extracted from another matrix is used instead of A\_ l (see 
Figure [SJ). 

The Checksum Function. The checksum C is computed from the blocks of 
message by iterating a non-linear checksum function, that we call G. Details on 
G are not relevant for our attacks. Basically G uses only basic operations like 
XOR and the S-box S. At a high-level, the following equations describe this 
mechanism: 


IC 0 = 0 

IC i+ i = G(ICj, Mi) 
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Fig. 3. The <f> function 


G is a complicated function, however it is straightforward to compute the 
intermediate checksum IQ from ICi+i and Mi. The final value IC n +i is the 
appended checksum C. A precise description of G is available in [7]. 

3 Collision Attacks Against MD2 

The only known cryptanalytic result against MD2 is the paper by Rogier and 
Chauvaud [H] . In this paper, collisions on the compression function of F are de- 
scribed. This attack works very well because the IV used in MD2 is O (although 
a variant is proposed for other IV’s with an increased complexity). Details of 
this attack are not essential here. The key idea is to use the symmetry between 
matrices B and C when H, = 0. (the first rows are equal in this case). Unfortu- 
nately collisions cannot be extended to the full MD2 because of the checksum 
bytes. 

Although collision attacks may be of interest in many contexts, there are 
several arguments why researching efficient collision attacks for MD2 is no longer 
a major concern. 

— First, one has to take into account the dimension of MD2. The produced 
hashed values have length only 128 bits. Therefore birthday paradox attacks 
have complexity of the order of 2 64 . This is not a satisfying level of security for 
modern applications. As an example, the MD5 hash function (whose output 
have also a length of 128 bits) is actually the subject of a distributed attack to 
find collisions [5] . It is clear that the interest of finding complicated shortcut 
attacks diminishes when efficient attacks using a large computational power 
are possible [TS] . 

— Secondly, MD2 is no longer widely used in practice. For instance, in MAC or 
signatures, the collision resistance of a hash function is generally a require- 
ment, but MD2 is no longer recommended for such applications. However, 
as we mentioned previously, MD2 is still used in some certificates. In this 
context, collision resistance is not really a concern but preimage and second 
preimage resistance are required. 
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4 Preimage Attacks Against MD2 Compression Function 

A large variety of definitions for preimage and second preimage attacks exist in 
the literature, depending on what is a fixed challenge for the attacker and what 
can be freely chosen. A classical reference is [S], however a new classification of 
these notions has been recently given in D3I- 

In this section, we focus only on (preimage) attacks against the compression 
function of MD2. It is well known that these attacks can generally be extended 
to attacks against the whole hash (see [S]). 

4.1 Three Scenarios 

According to the previous notations, the compression function F operates by: 
H i+1 = F(Hi,Mi) 

where the Hi s axe intermediate hash values and M, : is a message block (see 
Section [2721) . Basically we can consider 3 attack scenarios at this point: 

1. 1 and Hi are given and the attacker must find an appropriate M ,. 

2. H i+ 1 and Mi are given and the attacker must find an appropriate Hj. 

3. Hi + 1 is given and the attacker must find appropriate Hj and M t . 

Any of these attacks may be of interest to attack the whole hash. Obviously, 
the 1st and 2nd attack are very similar because the roles of Hi and Mj in F are 
almost symmetric. 

These 3 attack scenarios have received different names in the literature. Re- 
cently the names “aPre” (“a” stands for “always”), “ePre” (“e” stands for “ev- 
erywhere”) and “Pre” have been given to these 3 notions jT5] . In [S], the ter- 
minology of “preimage resistance” and “pseudo-preimage resistance” is used. In 
the following sections, we envisage each scenario separately and propose new 
attacks. 

4.2 Attacking Scenario 1 

In this scenario, we suppose that Hi and H i+ \ are a fixed challenge and our goal 
is to find an appropriate Mi such that 

H i+1 =F(Hi,Mi) 

First, we notice that a solution does not necessarily exist. Indeed all variables 
have length 128 bits, so in average only one solution Mi is expected, but there is 
no guarantee. We propose an attack that recovers all solutions corresponding to a 
given challenge (Hi, H i+1 ). Basically our attack is a sophisticated combination of 
exhaustive search and meet-in-the-middle attacks. It proceeds with two distinct 
steps. In the following, we call (mo, . . . , mis) the 16 bytes of Mj. 

First Step. The first step of the attack is to derive all possible information from 
the challenge (H, , H i+1 ). These two objects are stored at the first and last row 
of matrix A (see Figured] where dashed cells correspond to the known bytes). 
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Fig. 4. Initial knowledge when H i+ 1 and Hi are fixed 



Fig. 5. Known values in the matrix A 


Because of the structure of <i> (this function is used to compute the contents 
of the matrices, see Section [2~2ll . more information can be derived directly from 
the challenge. For instance, when A\_ 1 and A* are known, we can obtain A* -1 
since: 


A* = ^(A*- 1 , A*.!) 

= A|- x ® S(A*_j) 

In Figure 0 we represented by dashed boxes the large portion of A that 
can be directly derived this way. The second row is known because the byte 
introduced on the left hand side is known and always equal to 0. 

In addition, if we guess the byte introduced on the left hand side of 
the 3rd row in A (i.e. C{ 5 + 1), then we can derive the full content of matrix 
A by similar considerations. In particular the bytes A^ 5 ’s are known, and also 
the bytes CJ 5 ’s for i > 0. 

Second Step. Then, the second step of the attack is to perform a meet-in- 
the-middle attack on the matrices B and C to find an appropriate value of M t . 
Basically at this point, we know what enters on the left hand side of B and what 
exits on the right hand side of C. Hence, we apply the following “meet-in-the- 
middle” algorithm: 
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— Guess the 4 bytes (B {-, . . . , Bf 5 ) 

• for all values of the 8 bytes (mo, . . . , TO7), 

* compute the 4 bytes ( B 7, . . . , B 4 ) (this is possible because the se- 
quence of A \ 5 ’ s is known) 

* compute the 4 bytes (Cj , . . . , C' 4 ) (this is possible because Hi is 
known) 

* store these 4 + 4 = 8 bytes in a table T x 

• sort Ti (which has 2 64 entries of 64 bits each) 

• Repeat the same process with (ms, ■ ■ ■ ,77115) to obtain a table T 2 that 
contains also the bytes (B], , B 4 , C},. . . , Cf). 

• Find all collisions between 3\ and T2. This can be done efficiently by 
computing the joint product T = T) tx T 2 (see [TO]) with complexity of 
the order of 2 64 

• The resulting table T contains on average 2 64 candidate values for M t = 

(m 0 ,...,TOi 5 ) 

• Loop over all these candidates to find all valid Mi's 

One can also refer to Figure [6] for the general philosophy of this attack. 
Dashed boxes represent the 8 bytes stored in tables 7j and T 2 , where we look 
for collisions. 



Fig. 6. The general philosophy of the attack 


Analysis. In this attack, there are two outside loops. A loop of size 2 8 comes 
from the First Step of the attack (we need to guess one byte in order to find 
the full content of A). Besides an outside loop of length 2 32 is required in the 
“meet-in-the-middle” algorithm. Inside these loops we need to create and to sort 
the tables T\ and T 2 . Those are tables with 2 64 entrees, sorted using a key of 64 
bits. Sorting the tables can be done efficiently with an appropriate “bucket-sort” 
algorithm so the cost is above 2 64 instructions. Creating the tables has also a 
cost of the order of 2 64 instructions. Since these two operations are performed 
twice (once for Tj and once for T 2 ), the complexity is of the order of 

Complexity = 2 8 x 2 32 x (4 x 2 64 ) = 2 106 

basic instructions. This corresponds approximatively to 2 95 applications of the 
compression function (a quick estimation shows that about 2 11 instructions are 
needed for the compression function). 
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This should be compared to the complexity of an exhaustive search to find a 
preimage which would cost 2 128 applications of the compression function. How- 
ever, our attack requires about 2 71 bits of memory. High memory requirements 
are known to increase the “real” cost of attacks [2D] . Nevertheless this complex- 
ity is of the order of 2 3 "/ 4 while 2” would be expected for a good compression 
function on n bits. An improved attack is also proposed in Appendix (Alto reduce 
these memory requirements. Further improvements have been investigated but 
no attack with complexity below 2 3 "/ 4 was found. 

4.3 Attacking Scenario 2 

In the second scenario, the message block Mj is fixed and we search an appro- 
priate Hi. Attacking this scenario is very similar to attacking scenario 1 because 
there is an important symmetry in the compression function. 

In the previous attack we managed to reconstruct the content of A from the 
initial challenge, and then applied a “meet-in-the-middle” attack to B and C. In 
Scenario 2, we can reconstruct the content of B from the challenge (Mj, -ffj+i) 
and then attack by the middle the matrices A and C. Details of this attack are 
not very helpful to break the full MD2 hash, so we decided not to explore further 
this scenario. 

4.4 Attacking Scenario 3 

Finally, we suppose that only H i+ \ is fixed, and the problem is to find any pair 
(Hi, solution of the equation 

H i+1 = F(Hi,Mi) 

This type of attack is often referred to as a pseudo-preimage attack on the 
compression function [5]. Of course, it is easier to find such a solution because 
we have more degrees of freedom. Therefore we wish to find an attack with 
complexity better than the previous 2 95 . In this section, we describe an attack 
with complexity of the order of 2 73 against this scenario. 

The Attack. First, one should notice that many solutions exist to this problem. 
Indeed, we expect 

ol28 Y ol28 
z x z _ 9 128 
2 U28 

solutions in average. Therefore it is reasonable to impose some additional con- 
straints. 

Like for the previous attacks, we first derive all possible information from 
the given challenge (Hj+i here). In addition, we impose the constraint that 
A\ 5 = Aj 5 = c, where c is some constant, say c = 0 for instance. Figure [7] 
represents the resulting known values in the matrix A. 

We observe that the complete rightmost column of A is known, which helps 
when considering the behavior of matrix B. At this point, a 6 bytes constant 
(fc 0 , ■ ■ ■ ; fcs) is chosen at random. Then we apply the following algorithm: 
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Fig. 7. Known values in the matrix A 


— Pick 2 72 messages Mj of the form 

Mi = (mo, . . . ,mg, ko, ■ ■ ■ , Ate) 

where the m/s are chosen at random. It is straightforward to compute the 
matrix B for each Mi since the rightmost column of A is known. Hence we 
build a table T (with 2 72 entries) where we store the rightmost column of 
B, i.e. the B\$ s. 

— Pick 2 64 intermediate hashes Hi of the form 

Hi = (ho, ■ ■ ■ , hg, ko , . . . , Ate) 

where the Aij’s are chosen at randon0. It is straightforward to compute the 
complete matrix A for each Hi. Therefore all values C[ 5 for i > 0 are also 
known. Besides 

Hi® Mi = (*,..., *,k 0 ®k 0 ,...,k 5 ® Ate) 

thus the 6 rightmost boxes of the first row of C are known and equal to 0. 
Hence a lot of information about C can be derived (see Figure [5]) ■ By the 
way, the bytes B\ 5 for 11 < i < 17 are also known at this point. We store 
these elements in a table T'. 

The final step of the attack is to find collisions on the objects of 56 bits 
(B\l...,B\l) 

that have been computed by two different means and stored in tables T and T' . 
Using the birthday paradox, we expect 2 80 collisions because 

|Tj x \T'\ x 2 - 56 = 2 72 x 2 64 x 2 " 56 = 2 80 


Actually there is an extra constraint, that 0 (Aq) = Aq. Thus only 1 out of 256 values 
of Hi are valid. Once (hi , . . . , hg) are chosen, the value of ho is fully determined. 
This induce no extra cost but must be taken into account when choosing the Hi s. 


224 


F. Muller 



Fig. 8. Known values in the matrix C 


All these collisions can be found efficiently by computing T m T' (see USD- 
Each collision corresponds to some pair (Hi, Mi). In order for this pair to solve 
the initial problem, we need an additional equality between 

- the bytes , B]^) stored in table T 

— the value of the same bytes obtained when we fill up all the content of matrix 
C (which is possible for each candidate since Hi © M, is now known). 

Hence a little extra processing is required to find a real solution and a condi- 
tion on 80 bits must be verified. However, we have 2 80 candidates from the joint 
product of T and T' so one “real” solution should be found among them. The 
probability of failure (i.e. that no solution exists) can be roughly approximated 
to - ~ 0.368. Otherwise, we can pick a little more candidates for Mi and Hi or 
choose other constants. 

Analysis. The bottleneck in the previous attack is the time spent analyzing 
each of the 2 80 candidates (Hi, Mi). However, using an “early-abort” strategy, 
most candidates can be eliminated after the first check for the value B\ 5 . There- 
fore, only half a row of matrix C must be computed in average. To compute the 
compression function, 3 X 18 = 54 rows are computed. So we have a speedup by 
a factor 

2 x 54 ~ 2 6 ' 75 

compared to a full computation of F. 

Therefore this pseudo-preimage attack has complexity of about 2 73 - 25 com- 
putations of the compression function, and requires about 2 78 bits of memory. 
This is much faster than the expected value of 2 128 . All attacks against the 
compression function are summarized in Table [T| 
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Table 1. Summary of the attacks against the compression function 


Attack 

Fixed Challenge 

Variable 

Time 

Memory 

Simple 

H i+ 1 and Hi 

Mi 

2 yb 

2' 1 

Improved 

H i+ 1 and Hi 

Mi 

2 95 

2 38 

Pseudo-Preimage 

H i+ 1 

Hi and Mi 

2 7S 

2 78 


5 Preimage Attacks for the Full MD2 Hash 

The objective of a preimage attack is, for a given challenge h, to find a message 
m such that hashing m with MD2 gives h: 

MD2(m) = h 

Classical techniques exist to turn attacks against the compression function 
into attacks against the full hash. However they apply to classical iterated hash 
functions, like those based on the Merkle-Damgard paradigm. The use of an 
additional checksum in MD2 make things slightly more complicated. 

5.1 Attacking MD2 Without the Checksum 

If we omit the checksum, it is straightforward to apply the previous attacks 
directly to MD2. For instance, the attack described in Section FOl is immediately 
useful. Indeed, for a given (H t . we are able to find M. t such that: 

H i+ 1 = ) 

faster than exhaustive search. If we take = 0 (i.e. the IV of the MD2 spec- 
ifications) and H i+ i = h (the target value), the message of 1 block to = Mj 
basically solves the preimage problem (some extra work might be necessary to 
ensure the padding is correct). Anyway, this clearly no longer works when the 
checksum block is appended at the end. 

Preimage attacks against the full hash can also be found based on a pseudo- 
preimage attack (like the one described in Section 14.41 with complexity 2 73 ). For 
instance, a general meet-in-the-middle technique is: 

— Pick 2 100 random values of the first block of message Mi, and store all 
intermediate hashes H\ in a table T\. 

— Apply 2 28 times the pseudo-preimage attack and, for each solution (H 2 , M 2 ), 
store the intermediate hash H 2 in a table T 2 . 

— Search for a collision between some Hi in table Ti and some H 2 in table T 2 . 
The corresponding message to = (Mi, M 2 ) is a solution. 

Since 2 100 x 2 28 = 2 128 , a collision is indeed expected. Hence this attack builds 
a solution to of length two blocks and has complexity of the order of 2 101 , which 
is faster than exhaustive search. However when the checksum is used, this input 
message is likely to be invalid. Indeed, we need a collision on the intermediate 
hash values and the intermediate checksums simultaneously. 
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5.2 A Chaining Attack 

The principle of chaining attacks is to iterate an attack against the compression 
function, while chaining the intermediate variables used in each attack. Here, we 
first choose at random a sequence of intermediate hashes of the form: 

0 = Ho, Hi , . . . , f?i27) H 12 S = h 

For each pair (Hi, H i+ i), we apply the attack of Section 11.21 to find all solu- 
tions of: 

17*4-1 = F(Hi,Mi) 

A constraint we add is that at least two solutions M* and M[ must be found, 
for all i. Assuming F is a random function, this should happen with a reasonable 
probability (called p). It can roughly be approximated by 1 minus the probability 
to have exactly 0 or 1 solution: 

p ~ 1 - (1 - 2- 128 ) 2128 - 1 - (1 - 2“ 128 ) 2128 

~l-2e“ 1 
a 0.264 

If there are less than 2 solutions, we throw away H i+ i and pick another value. 
In average, we need to apply 128 X p -1 ~ 2 9 times the attack of Section 14.21 to 
find an appropriate pair of solutions (M l: M[) for all i. 

Then, we have 2 128 possible messages that are solution of the preimage prob- 
lem for MD2 with challenge h (there are 2 possible blocks of message for all i). 
Among them, one of the message is likely to satisfy the checksum constraint, i.e. 
its last block should be the checksum of the 127 previous blocks. To find this 
message, a simple meet-in-the-middle attack applies: 

— Compute the 2 64 intermediate checksums IC64 by testing the two possible 
blocks of message at all positions i, 0 < i < 63. 

— Compute the 2 64 intermediate checksums IC64 by inverting the checksum 
function G, starting for both values M127 and M[ 27 , and for all blocks of 
message at positions *,64 < i < 127. 

— Search for a collision between these 2 lists of 2 64 elements 

This technique is similar to the one used in [6]. The resulting attack against 
the full hash is only marginally slower than the attack against the compression 
function, since the deterioration corresponds to a factor 2 9 . Therefore it will 
cost about 2 95 x 2 9 = 2 104 applications of the compression function. In addi- 
tion, a memory of 2 n bits is required (or 2 38 using the improved algorithm of 
Appendix EJ ■ This is much faster than a naive exhaustive search. 

6 Second Preimage Attacks 

A second preimage attack consists, on the challenge of a message m, to provide 
a second message nn! which gives the same MD2 hash: 

MD2(m) = MD2(m') 
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The resistance of MD2 against this type of attack is critical for the security 
of existing certificates. Indeed a certificate generally consists in a data part m 
and a signature of the data part. To compute this signature, a hash of the data 
part is generally computed. If an attacker is able to replace m with an other 
data part m! mapping to the same hash, he is able to forge a new certificate. 

If we omit the checksum blocks for MD2, it is straightforward to find a second 
preimage, based on the previous attacks. For any of the intermediate steps 

H i+1 = F(Hi,Mi) 

in the original message to, we apply the attack described in Section 14.21 With 
probability p ~ 0.26, another message block M-, mapping Hi to H i+ i is found. 
Then we can simply substitute M[ to to forge a new certificate. 

Unfortunately, when the checksum is used, this attack no longer works be- 
cause the checksum is altered by the previous substitution. Therefore the last 
block of message is no longer valid. 

We could not find a dedicated second preimage attack against the full MD2, 
including the checksum bytes. An attack is still possible by applying a preimage 
attack on h = MD2(to). The result m' is a preimage of h and is very likely to 
be different from to. Unfortunately m! is very constrained: 

- its length is at least 128 blocks (including the checksum block), so the mes- 
sage to' is of length > 2 Kbytes. Some variants of the attack can increase 
this message length but it is not possible to reduce it. This is slightly larger 
than a typical certificate, however a trade-off between the size of the forged 
certificate and the probability of success could also be envisaged. 

— at least 128 blocks in the forged certificates are random and therefore cannot 
be chosen by the attacker. 

All together, it seems difficult for the moment to forge new certificates that 
respect the required format. However we are not far from it and we think it 
is an interesting topic for further research. We encourage a deeper analysis of 
the MD2 hash function whose security, especially regarding (second) preimage 
attacks is important for many existing certificates. 

7 Conclusion 

In this paper, we described preimage and pseudo-preimage attacks against the 
compression function of MD2, the best of which has complexity 2 73 . The re- 
sulting attack against the full hash (including the checksum) costs about 2 104 
applications of the compression function. As a consequence, MD2 can no longer 
be considered a secure one-way hash function. 

These results are also very interesting from a theoretical point of view, be- 
cause preimage attacks against hash functions are quite rare. Most of the research 
in recent years has focused on finding collisions for hash functions. 
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A A Memory-Efficient Attack 

The attack described in Section 14.21 is much faster than an exhaustive search, 
however the large memory requirements make it highly unpractical and prob- 
ably contributes to under-estimate the “real” complexity. Here, we propose an 
improved attack regarding the data complexity. 

The general idea of the attack of Section 14.21 is to split the target Mj in two 
halves (m 0 ,...,m 7 ) and (to 8 ,...,toi 5 ) of 64 bits each. The improved attack 
consists in splitting Mj in 4 parts instead of 2 using the following algorithm: 

- Guess the 6 bytes {(B 4 , B 2 ), (B} 5 , B 2 5 ), (Cf, Cf )} 

• guess the 4 bytes mo, . . . , m3 

* compute and store in table Tj the bytes B \ , B| , C3 , Cf 

• guess the 4 bytes m 4 , . . . , m 7 

* compute and store in table T2 the bytes B| , B3 , Cf, Cf 

• guess the 4 bytes m 8 , . . . , mu 

* compute and store in table T 3 the bytes Bf . B'^ , Cjf , C 2 :1 

• guess the 4 bytes mi2, . . . , mis 

* compute and store in table T 4 the bytes B l rl . Bfj , 

• Compute the joint product T = Ti ix T 2 of size 2 32 . It contains candidate 
values for (mo, . . . , m 7 ). 

• Compute the joint product T' = T3 m T 4 of size 2 32 . It contains candi- 
date values for (m 8 , . . . , mis). 

• Guess 2 additional bytes Bis and Bf 5 

* For each element of T compute the 4 bytes B|, B 7 , C 3 , C 7 

* Compute similarly these 4 bytes for each element of T' 

* Search for a collision in the two resulting lists. 

• This results in a list of 2 32 candidates for (mo, . . . , mis). 

This slightly more complex attack has complexity of the order of 
2 8 x 2 48 x 2 16 x 2 32 ~ 2 104 

instructions, like previously. However the largest tables we handle have 2 32 en- 
tries of 32 bits. The philosophy of this improved attack is described in Figured 


known initial guess initial guess initial guess known 

value (16 bits) (16 bits) (16 bits) value 
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Fig. 9. The general philosophy of the improved attack 
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Abstract. We investigate efficient protocols for password-authenticated 
key exchange based on the RSA public-key cryptosystem. To date, most 
of the published protocols for password-authenticated key exchange were 
based on Diffie-Hellman key exchange. It seems difficult to design efficient 
password-authenticated key exchange protocols using RSA and other 
public-key cryptographic techniques. In fact, many of the proposed pro- 
tocols for password-authenticated key exchange based on RSA have been 
shown to be insecure; the only one that remains secure is the SNAPI pro- 
tocol. Unfortunately, the SNAPI protocol has to use a prime public ex- 
ponent e larger than the RSA modulus n. In this paper, we present a new 
password-authenticated key exchange protocol, called PEKEP, which al- 
lows using both large and small prime numbers as RSA public exponent. 
Based on number-theoretic techniques, we show that the new protocol is 
secure against the e-residue attack , a special type of off-line dictionary 
attack against RSA-based password-authenticated key exchange proto- 
cols. We also provide a formal security analysis of PEKEP under the 
RSA assumption and the random oracle model. On the basis of PEKEP, 
we present a computationally-efficient key exchange protocol to mitigate 
the burden on communication entities. 


1 Introduction 

The design of authentication and key exchange protocol is usually based on the 
assumption that entities either share or own some secret data (called keys) which 
are drawn from a space so large that an adversary can not enumerate, either on- 
line or off-line, all possible keys in the space. In practice, however, cryptographic 
keys may often be substituted by human-memorable passwords consisting of only 
six to ten characters. The consequence is the proliferation of the so-called exhaus- 
tive guessing or dictionary attacks against many password-based systems [26] . 
Password guessing attacks have been around for so long, it seems paradoxical 
that strong authentication using only small passwords would be possible. In 1992, 
Bellovin and Merritt [5] showed that such paradoxical protocols did exist. They 
presented a family of protocols known as Encrypted Key Exchange , or EKE. By 
using a combination of symmetric and asymmetric (public-key) cryptographic 
techniques, EKE provides insufficient information for an adversary to verify a 
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guessed password and thus defeats off-line dictionary attacks. Following EKE, a 
number of protocols for password-based authentication and key exchange have 
been proposed, e.g., [2, 6, 8, 10, 11, 13, 15-17, 21, 25] A comprehensive list of 
such protocols can be found in Jablon’s research link m- 

Password-authenticated key exchange protocols are attractive for their sim- 
plicity and convenience and have received much interest in the research commu- 
nity. Over the last decade, many researchers have investigated the feasibility of 
implementing EKE using different public-key cryptosystems such as RSA, ElGa- 
mal, and Diffie-ffellman key exchange. Nonetheless, most of the well-known and 
secure variants of EKE are based on Diffie-Hellman key exchange. It seems that 
EKE works well with Diffie-Hellman key exchange, but presents subtleties when 
implemented with RSA and other public-key cryptosystems. In their original 
paper [5], Bellovin and Merritt pointed out that the RSA-based EKE variant is 
subject to a special type of dictionary attack, called e-residue attack. Based on 
number-theoretic techniques, Patel [22] further investigated the security of the 
RSA-based EKE variant and concluded that simple modifications of EKE would 
not prevent the RSA-based EKE variant from off-line dictionary attacks. In 
1997, Lucks [TS] proposed an RSA-based password-authenticated key exchange 
protocol (called OKE) which was claimed to be secure against the e-residue 
attack. Later, Mackenzie et al. m found that the OKE protocol is still sub- 
ject to the e-residue attack. In [15], Mackenzie et al. proposed an RSA-based 
password-authenticated key exchange protocol (SNAPI) and provided a formal 
security proof in the random oracle model. The SNAPI protocol mandates that 
the public exponent e be a prime number larger than the RSA modulus n. This 
ensures that e is relatively prime to <p(n). 

To avoid using large public exponents, Zhu et al. [57] proposed an “interac- 
tive” protocol which is revised from an idea of [5]. In the interactive protocol, 
Bob sends to Alice a number of messages encrypted using Alice’s public key. If 
Alice can successfully decrypt the encrypted messages, then Bob is ensured that 
the encryption based on Alice’s public key is a permutation. In [13], Wong et al. 
revised the interactive protocol of [57] to reduce the message size involved in the 
interactive protocol. Recently, Catalano et al. [5] proposed an interactive pro- 
tocol similar to that of m and provided a security proof in the random oracle 
model. A drawback of the interactive protocols J27][231[5] is the large communi- 
cation overhead involved in the verification of RSA public key. 

In this paper, we investigate RSA-based password-authenticated key ex- 
change protocols that can use both large and small primes as RSA public ex- 
ponent, but without inducing large communication overhead on communication 
entities. For this purpose, we develop a new protocol for password-authenticated 
key exchange based on RSA. The new protocol, called PEKEP, involves two 
entities, Alice and Bob, who share a short password and Alice possesses a pair 
of RSA keys, n, e and d, where ed= 1 (mod 4>(nj). Unlike the protocol SNAPI, 
however, the new protocol PEKEP allows Alice to select both large and small 
primes for the RSA public exponent e. In the protocol PEKEP, Bob does not 
need to verify if e is relatively prime to (j>(n ), and furthermore, Bob does not 
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have to test the primality of a large public exponent selected by Alice. Thus, the 
protocol PEKEP improves on SNAPI by reducing the cost of primality test of 
RSA public exponents. The protocol PEKEP also improves on the interactive 
protocols of [271[231[5] by reducing the size of messages communicated between 
Alice and Bob. Based on number-theoretic techniques, we prove that the proto- 
col PEKEP is secure against the e-residue attack as described in [5j|22]. We also 
provide a formal security analysis of PEKEP under the RSA assumption and 
the random oracle model. 

To further reduce the computational load on entities, we present a computa- 
tionally efficient key exchange protocol (called CEKEP) in this paper. The pro- 
tocol CEKEP is derived from PEKEP by adding two additional flows between 
Alice and Bob. With the two additional flows, we show that the probability 
for an adversary to launch a successful e-residue attack against CEKEP is less 
than or equal to e, where e is a small number (e.g., 0 < e < 2 -80 ) selected 
by Bob. In the protocol CEKEP, the computational burden on Bob includes 
two modular exponentiations, each having an exponent of C?([log 2 e -1 ]) bits. 
When e = 2 -80 , for example, the computational burden on Bob is lighter than 
that in a Diffie-Hellman based password-authenticated key exchange protocol. 
In the Diffie-Hellman based EKE variant, Bob needs to compute two modular 
exponentiations, each having an exponent of at least 160 bits. 

The rest of the paper is organized as follows. We provide an overview of 
the security model for password-authenticated key exchange in Section 2. In 
Section 3, we present the protocol PEKEP and investigate its security against 
e-residue attack. We describe the protocol CEKEP in Section 4 and pursue 
formal security analysis of PEKEP and CEKEP in Section 5. We conclude in 
Section 6. 


2 Security Model 

We consider two-party protocols for authenticated key-exchange using human- 
memorable passwords. In its simplest form, such a protocol involves two entities, 
say Alice and Bob (denoted by A and B), both possessing a secret password 
drawn from a small password space V. Based on the password, Alice and Bob 
can authenticate each other and upon a successful authentication, establish a 
session key which is known to nobody but the two of them. There is present 
an active adversary, denoted by A, who intends to defeat the goal for the pro- 
tocol. The adversary has full control of the communications between Alice and 
Bob. She can deliver messages out of order and to unintended recipients, con- 
coct messages of her own choosing, and create multiple instances of entities and 
communicate with these instances in parallel sessions. She can also enumerate, 
off-line, all the passwords in the password space V. She can even acquire session 
keys of accepted entity instances. Our formal model of security for password- 
authenticated key exchange protocols is based on that of [2]. In the following, 
we review the operations of the adversary and formulate the definition of secu- 
rity. For details of the security model, we refer the readers to [2] . 
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Initialization. Let I denote the identities of the protocol participants. Ele- 
ments of I will often be denoted A and B (Alice and Bob). We emphasis that 
A and B are variables ranging over I and not fixed members of I. Each pair of 
entities, A, B £ I, are assigned a password w which is randomly selected from 
the password space V. The initialization process may also specify a set of crypto- 
graphic functions (e.g., hash functions) and establish a number of cryptographic 
parameters. 

Running the Protocol. Mathematically, a protocol II is a, probabilistic 
polynomial-time algorithm which determines how entities behave in response 
to received message. For each entity, there may be multiple instances running 
the protocol in parallel. We denote the i-th instance of entity A as II l A . The 
adversary A can make queries to any instance; she has an endless supply of II' A 
oracles (A £ I and i g N). In response to each query, an instance updates its 
internal state and gives its output to the adversary. At any point in time, the in- 
stance may accept and possesses a session key sk, a session id sid, and a partner 
id pid. The query types, as defined in [2] , include: 

- Send (A, i, M ): This sends message M to instance Id\. The instance executes 
as specified by the protocol and sends back its response to the adversary. 
Should the instance accept, this fact, as well as the session id and partner 
id will be made visible to the adversary. 

- Execute(A, i, B, j): This call carries out an honest execution between two 
instances II A and II B , where A. B £ I , A / B and instances W A and II B 
were not used before. At the end of the execution, a transcript is given to the 
adversary, which logs everything an adversary could see during the execution 
(for details, see [2]). 

- Reveal (A, i): The session key sk A of II A is given to the adversary. 

- Test(A, i): The instance U\ generates a random bit b and outputs its session 
key sk A to the adversary if b = 1, or else a random session key if b = 0. This 
query is allowed only once, at any time during the adversary’s execution. 

- Oracle(M): This gives the adversary oracle access to a function h, which is 
selected at random from some probability space 12. The choice of fl deter- 
mines whether we are working in the standard model, or in the random-oracle 
model (see [2] for further explanations). 

Note that the Execute query type can be implemented by using the Send 
query type. The Execute query type reflects the adversary’s ability to passively 
eavesdrop on protocol execution. As well shall see, the adversary shall learn 
nothing about the password or the session key from such oracle calls. The Send 
query type allows the adversary to interact with entity instances and to carry 
out an active man-in-the-middle attack on the protocol execution. 

Definition. Let II A and W B , A / B, be a pair of instances. We say that IJ A 
and II B are partnered if both instances have accepted and hold the same session 
id sid and the same session key sk. Here, we define the sid of 1I A (or II B ) as the 
concatenation of all the messages sent and received by IJ A (or II B ). We say that 
II A is fresh if: i) it has accepted; and ii) a Reveal query has not been called either 
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on II\ or on its partner (if there is one). With these notions, we now define the 
advantage of the adversary A in attacking the protocol. Let Succ denote the 
event that A asks a single Test query on a fresh instance, outputs a bit b', and 
b' = b, where b is the bit selected during the Test query. The advantage of the 
adversary A is defined as Adv^ fce = 2Pr(Succ) — 1. 

It is clear that a polynomial-time adversary A can always gain an advantage 
close to 1 if we do not limit her capability to perform on-line password-guessing 
attacks. In such an attack, the adversary picks a password tt as her guess and then 
impersonates as an instance W A to start the protocol towards another instance 
n J B . By observing the decision of II J B (i.e., accepts or rejects), the adversary can 
test the correctness of the guessed password n. Furthermore, by analyzing, off- 
line, the transcript of the execution, the adversary may be able to test passwords 
other than 7 r. For a secure protocol, we expect that the adversary can only test 
a single password in each on-line password-guessing attack. As suggested in m , 
we use the Send query type to count the number of on-line guesses performed by 
the adversary. We only count one Send query for each entity instance, that is, if 
the adversary sends two Send queries to an entity instance, it should still count 
as a single password guess. Based on this idea, we have the following definition 
of secure password-authenticated key exchange protocol, which is the same as 

in HD]- 

Definition 1. A protocol II is called, a secure pas sword- authenticated key ex- 
change protocol if for every polynomial-time adversary A that makes at most 
Qsend ( Qsend. < |T>|) queries of Send type to different instances, the following 
two conditions are satisfied: 

(1) Except with negligible probability, each oracle call Execute ("A, i, B, j ) produces 
a pair of partnered instances II A and II B . 

(2) Adv^ fee < Qsend,/ \D\ + e, where \ D\ denotes the size of the password space 
and e is a negligible function of security parameters. 

The first condition basically says that when the adversary carries out an 
honest execution between two instances W A and II B ( A / =B), both instances 
accept and hold the same session key and the same session id. The second con- 
dition means that the advantage of the adversary is at most negligibly more 
than Qsend/\D\ if she sends at most Q sen d queries of Send type to different en- 
tity instances, or equivalently, if she interacts on-line with at most Q se nd entity 
instances using the Send query type. 

3 Password Enabled Key Exchange Protocol 

In this section, we present a new protocol, called Password Enabled Key Ex- 
change Protocol, or simply, PEKEP. In the protocol PEKEP, there are two enti- 
ties, Alice and Bob, who share a password w drawn at random from the password 
space V and Alice has also generated a pair of RSA keys n, e and d, where n is 
a large positive integer (e.g., n > 2 1023 ) equal to the product of two primes of 
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(roughly) the same size, e is a positive integer relatively prime to 4>(n), and d is a 
positive integer such that ed = 1 (mod <i>(n)). The encryption function is define 
by E(x) = x e mod n, x G Z„. The decryption function is D(x) = x d mod n. 
For a positive integer to, we define E rn recursively as E m ( x) = E(E m ~ 1 (x)) = 
x e mod n. Likewise, D rn (x) = D(D rn ^ 1 (x)) = x d mod n. Before describing 
the protocol, let’s review some of the facts of number theory. 

Let o be a positive integer relatively prime to n, we say that a is an e-th 
power residue of n if the congruence x e = a (mod n) has a solution in Z* . Let 
g be a positive integer relatively prime to n. The least positive integer i such 
that g l = 1 (mod n) is called the order of g modulo n. If the order of g is equal 
to cf>(n), then g is called a primitive root of n. It is known (see [lj[23]) that a 
positive integer n, n > 1, possesses a primitive root if and only if n = 2,4 ,p t or 
2 p 4 , where p is an odd prime and t is a positive integer. If n has a primitive root 
g, then a positive integer a relatively prime to n can be represented as a = g l 


Alice (A) 
password: w 

RSA keys: n, e, d 


Bob (B) 
password: w 

r A €r {0, l} fc 

r A , n, e, A 




e odd prime? and n odd? 
If yes, m = [log e nj 

a e R z;, r B e R {o, i} fc 

a = H(w, r A , r B ,A, B, n, e) 
If gcd(a, n) = 1, A = a 
else A Gr 
* = £ m (AK(a)) 

a = H(w,r A ,r B ,A,B,n, e) 

If gcd(a, n) f=l,b e R Z„ 
else b = D(a~ 1 D m (z)) 
p = Hi(b, rA,r B ,A,B,n,e ) 

P 



V 

p = Hi (a, r A , r B ,A, B , n, e) 
Reject if not, else 
t] = H 2 (a, r A , r B ,A , B , n, e) 
sk = H 3 (a , r A , r B ,A , B , n, e) 

g i H 2 (b, r A ,r B , A, B, n, e) 

Reject if not, else 

sk = H 3 (b, r At r B ,A, B, n, e) 


Fig. 1. Password Enabled Key Exchange Protocol (PEKEP) 
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mod n, 0 < i < <j>(n) — 1. The integer i is called the index of a to the base g 
modulo n, and is denoted by ind s a. 

Define hash functions Hi, H%, H$ : {0,1}* —> {0, l} fc and H : {0,1}* — > Z„, 
where k is a security parameter, e.g., k = 160. Note that H can be implemented 
using a standard hash function h : {0, 1}* — * {0, 1 }*, where l is the length of n, 
i.e., I = flog 2 n\. On input x,H(x) = h(x), if h(x) < n, and H(x) = h(x)— [n/2] 
if else. The protocol PEKEP is described in Fig. 1. Alice starts the protocol by 
sending her public key (n, e) and a random number ta Gr {0, l} k to Bob. 
Bob verifies if e is an odd prime and n is an odd integer. Bob may also verify 
that the integer n is large enough, e.g., n > 2 1023 . If e is not an odd prime 
or n is not an odd integer, Bob rejects; otherwise, Bob computers an integer 
to = [log e nj and selects two random numbers a Gr Z*, and r B Gr {0, l} fc . 
Bob then computes a = H(w,rA,r B ,A,B,n,e) and checks if gcd(a, n) = 1. If 
gcd(a, n) / = 1, Bob assigns a random number to A; otherwise, Bob assigns 
a to A. Next, Bob computes 2 = E Tn (\E(a)) and sends r B and 2 to Alice. 
Subsequently, Alice computes a using her password w and checks if a and n 
are relatively prime. If gcd(a, n) / = 1, Alice assigns a random number to 
the variable b. If gcd(a, n) = 1 and 2 is an e m -th power residue of n, Alice sets 
b = D(a~ 1 D m (z)). Next, Alice and Bob authenticate each other using a and b 
and generate a session key sk upon successful authentication. 

Note that, when e is a prime number larger than n, Bob sets to = 0. In this 
case, the run of PEKEP is nearly identical to that of SNAPI. In the protocol 
PEKEP, Bob only verifies if the public exponent e is an odd prime and the 
RSA modulus n is an odd integer; Bob does not verify if e is relatively prime to 
<j)(n). This may foster the so-called e-residue attack as described in [51 [22]. In the 
e-residue attack, an adversary, say, Eva, selects tvq G V as her guess of Alice’s 
password. She also selects an odd prime number e and an odd integer n such 
that e | <j>(ri), i.e., (n,e) is not a valid RSA public key. Then Eva impersonates 
as Alice and starts the protocol PEKEP by sending r B ,n,e,A to Bob, where 
te G {0, l} fc is a random number generated by Eva. After receiving r B and 2 
from Bob, Eva computes p and sends it back to Bob. If Bob accepts, then Eva 
has a successful guess of Alice’s password (i.e., 7To). If Bob rejects, on the other 
hand, Eva excludes her guess 7To from the password space V. Furthermore, Eva 
may exclude more passwords by repeating, off-line, the following three steps: 

1) Eva selects a password 7r from V. 

2) Eva computes a = H{-K,r E ,r B ,A,B,n,e). 

3) Eva tests if gcd(cn,n) = 1. If not, Eva returns to step 1; otherwise, Eva 
verifies if the congruence (m e ) e ™ = 2 (mod n) has a solution in Z*. If the 
congruence has a solution, Eva returns to step 1. If the congruence has no 
solution in Z* , then Eva knows that 7 r is not the password of Alice. Next, 
Eva excludes 7 r from V and returns to step 1. 

We say that Eva succeeds if she can exclude more than one password in the 
e-residue attack as described above. In the following, we show that the protocol 
PEKEP is secure against e-residue attack. 
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Theorem 1. Let n, n > 1, be an odd integer with prime-power factorization 
n = p^p^ 2 ■ ■ -pf r ■ Let m be a non-negative integer and e an odd prime such that 
for any prime-power p“ 4 of the factorization of n, e m+1 \ 1 < i < r. If z 

is an e m -th power residue of n, then for any A e Z*, the congruence ( Xx e ) e = 
z (mod n) has a solution in Z* . 

Proof. To prove that (Ax 6 )'"’ = z (mod n) has a solution in Z*, we only need 
to prove that, for each prime power pff of the factorization of n, the following 
congruence 

(Ax e )® m = z (mod pf*) (1) 

has a solution in Z% . 

pP 

Let ni = pf * , 1 < i < r. Then <j>(m ) = p < f i ~ 1 {pi — 1). Since n is odd, pi is an 
odd prime. Thus, the integer n t possesses a primitive root. Let g be a primitive 
root of m, that is, g^ n 0 = 1 mod rq, and for any 0 < i,j < (^{nf) — l,i / 
g l / g3 mod Let gcd(e' m , <j>(n,;)) = e c ,0 < c < to. We consider the following 
two cases: 

(1) If c = 0, then e and <)>(rq) are relatively prime. In this case, it is clear 
that the congruence (Ax 6 ) 6 ”’ = z (mod rq) has a unique solution in Z* .. 

(2) Next, we consider the case that 1 < c < m. Since z is an e m -th power 
residue of n, the congruence y e = z (mod n) has solutions in Z* . By the Chinese 
Remainder Theorem, the following congruence 

y em = z (mod nf) (2) 

has solutions in Z* . Let ind 9 z denote the index of z to the base g modulo n, 
and let y e Z*. be a solution of (2), then ^e m md 9! /-ind ! ,z = ^ (mod nf). Since 
the order of g modulo rq is 0(n,), we have 

e m ind g y = ind g z (mod 4>(rii)) (3) 

Also since gcd(e m , </>(n,)) = e c , equation (3) has exactly e° incongruent solu- 
tions modulo when taking ind s jy as variable. This indicates that equation 
(2) has e c solutions in Z* . . Let y 0 denote one of the solutions of (2) , then the e c 
incongruent solutions of (3) are given by 

ind g y = ind g y 0 + t^(nj)/e c (mod ^(n*)), 0 < t < e c - 1. (4) 

For any A S Z*, we have 

ind g y — ind g A = ind ff j/o — ind g A + t<j)(ni)/e c (mod ^(n*)), 0 < t < e c — 1. 

Under the condition that e m+1 \ <p(ni), it is clear that e \ <j){rii)/e c . Hence, 
( i>(ni)/e c = 1 (mod e). So, there exists an integer t, 0 < t < e c — 1, such that 

ind g ?/o — ind g A + t(j>(ni)/e c = 0 (mod e), 

which implies that there exists an integer y £ Z*., such that y e = z (mod nf) 
and yA _1 is an e-th power residue of n, . Therefore, equation (1) has a solution 
in Z* . , which proves the theorem. □ 
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In PEKEP, Bob sets m equal to |_log e n \ ■ Thus, for every prime-power p“ 4 of 
the factorization of n, we have e m+1 > n > p“‘. By Theorem 1, for any A G Z*, 
the congruence ( Xx e ) em = 2 (mod n) has a solution in Z*, where 2 ; is the e-th 
power residue computed by Bob. Hence, by repeating (off-line) the three steps 
as described previously, Eva could not exclude any password from the space V. 
So, the protocol PEKEP is secure against e-residue attacks. In Section 5, we 
will provide a formal analysis of PEKEP within the security model described in 
Section 2. 

At the beginning of PEKEP, Bob needs to test the primality of the public 
exponent e selected by Alice. When e is small, e.g., e = 17, the primality test only 
induces moderate overhead on Bob. When e is large (e.g., e > 2 512 ), however, the 
computational load for the primality test would be tremendous. In the following, 
we show that primality test of large public exponents by Bob could be avoided 
with slight modification of PEKEP. In the protocol PEKEP, Bob can actually 
select a small prime number e! (e.g., e' = 3) and replaces Alice’s public key (n, e) 
by (n,e'), that is, Bob computes m,a,z,r],sk using (n, e') instead of Alice’s 
public key (n, e) . Theorem 1 demonstrates that the replacement does not lead 
to e-residue attacks, even if e' is not relatively prime to <j>(n). So, when the public 
exponent e received from Alice exceeds a threshold, Bob replaces e by a smaller 
prime number e' (2 < eJ < e ) of his own choosing. Bob sends tb,z, and e' to 
Alice in the second flow. After receiving e' from Bob, Alice tests if e! is relatively 
prime to (j>(ri). If gcd(e', d(n)) / = 1, Alice sends a random number € {0, l} fe to 
Bob; Alice may select a smaller prime number for e in the next communication 
session. If gcd(e', 4>(n)) = 1, Alice replaces her decryption key by dl and then 
proceeds as specified in Fig. 1, where e!d! = 1 (mod <j>(n)). 

In each run of PEKEP, Bob computes m + 1 encryptions using Alice’s public 
key (n, e), where m = |_log e nj . The computation time for the rn+1 encryptions is 
0((log 2 n) 3 ), which means that the computational load on Bob is about the same 
as that in SNAPI. As discussed above, however, Bob does not have to perform 
primality test of large public exponents. Hence, the protocol PEKEP still im- 
proves on SNAPI by reducing the cost of primality test of RSA public exponent. 
Since Alice has knowledge of she only needs to perform two decryptions in 
each run of PEKEP; one using the decryption key d\ = d and another using the 
decryption key d 2 = d m mod (j)(n ) . Note that the computational load on Bob is 
high even when e is small. In Section 4, we present a computationally-efRcient 
key exchange protocol which greatly reduces the computational load on Bob. 


4 Computationally-Efficient Key Exchange Protocol 

In this section, we present a Computationally-Efficient Key Exchange Proto- 
col (CEKEP), which is described in Fig. 2. The protocol CEKEP is based on 
PEKEP, but the number of encryptions performed by Bob is less than |_log e n \ > 
where (n, e) is the public key of Alice. In the protocol CEKEP, Bob selects a 
small number e, 0 < e < 2 -80 , which determines the probability of a successful 
e-residue attack against the protocol CEKEP. Alice starts the protocol CEKEP 
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by sending her public key n, e and two random numbers p. r A Gr {0, l} fc to Bob. 
Bob verifies if e is an odd prime and n is an odd integer. If not, Bob rejects. 
Else, Bob computers an integer m based on e and £ as m = [~log e £ _1 "|. Then 
Bob selects a random number g & R {0, l} fc such that 7 = H(n,e, p, g,A,B,m) 
is relatively prime to n. Bob sends g and m to Alice. After receiving o and to, 
Alice computes u = D m { 7) and sends it back to Bob. Subsequently, Bob verifies 
if Alice has made the right decryption, i.e., E m (u) = 7. If 7 / =E rn (u ) , Bob 
rejects. Else, Alice and Bob executes the rest of the protocol as in PEKEP. 


Alice (A) 


Bob (B) 

password: w 


password: w 

RSA keys: n, e, d 


0 < e < 2 -80 

p,r A €n {0, l} fc 

p,r A ,n,e,A 

e odd prime? and n odd? 
If yes, m = [log e e _1 ] 
Q €r {0, l} fc 

H(n, e, p, q, A, B, m) 

g, m 

H(n,e,p,e,A,B,m)e Z* n 

u = D m ( n ) 


7 - K"‘(u) 
Reject if not, else 
a £r Z*, rs 6 r {0, l} fc 
a = H(w,r A ,r B ,A,B,n, e) 
If gcd(a, n) = 1, A = a 
else A €lr Z; 

a = H(w, r A , r B ,A, B, n, e) 

If gcd(a, n) /= 1,6 £r Z„ 
elseb = D(\- 1 D m ~ 1 (z)) 


z = E m - 1 (\E(a)) 

p = H 1 (b,r A ,r B ,A,B,n,e) 

P 

p = Hi (a, r A ,r B ,A,B,n, e) 
Reject if not, else 
r 1 = H 2 (a, r A ,r B ,A,B,n, e ) 

r i = H 2 {b, r A , r B , A, B, n, e) 

Reject if not, else 

sk = H 3 (b, r A ,r B ,A, B, n, e) 

V 

sk = H 3 (a,r A ,r B ,A,B,n, e ) 


Fig. 2. Computationally-Efficient Key Exchange Protocol (CEKEP) 
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A major difference between CEKEP and PEKEP is that the protocol CEKEP 
adds two additional flows between Alice and Bob. Through the two flows, Alice 
and Bob establish a random number 7 g Z*. Then Alice decrypts the random 
number 7 repeatedly m times. If the m repeated decryption is correct, i.e., 
7 = E m (u), then it can be concluded that, except with probability as small 
as e -m , the integer e m does not divide (l>(pf i ) for every prime-power p“ 4 of the 
factorization of n. 

Theorem 2. Let n, n > 1 , be an odd integer with prime-power factorization 
n = p^p^ 2 ■ ■ -pf r ■ Let m be a positive integer and e an odd prime. If there exists 
a prime power, say pf* , of the factorization of n such that e m \ then for 

an integer 7 randomly selected from Z* , the probability that 7 is an e m -th power 
residue of n is less than or equal to e~ m . 

Proof. Let n t = be a prime power of the factorization of n such that e m | 
4>{ni). Since n is odd, rq possesses a primitive root. Let g be a primitive root of 
Hi. For an integer 7 randomly selected from Z* , let ind s 7 denote the index of 7 
to the base g modulo rq. Then 7 is an e m -th power residue of n i: if and only if 
the congruence x e =7 (mod nf) has a solution, or equivalently, if and only if 

5 e-ind 9 z-ind 97 jg j ( mod ^ 


which is equivalent to 


e m ind s x = ind s 7 (mod </>(rq)). 

Since e m | 0(rq), 7 is an e m -th power residue of rq if and only if e m | ind ff 7- 
Let n! i = n / n-i , then rq and n' are relatively prime. For any integer (3 £ 
Z*, it is clear that (3 mod n* and (3 mod n' are integers of Z*. and Z*,, 
respectively. On the other hand, for two integers aq £ Z*. and a 2 S Z*,, by 
the Chinese Remainder Theorem, there is an unique integer a £ Z* , such that 
a = a\ (mod rq), and a = a 2 (mod n'f). So, the number of integers a £ Z* 
which satisfy the congruence a = oq ( mod nf) is (pinf). If 7 is randomly selected 
from Z* , then for any integer s, 0 < s < — 1 , we have 

Pr(g s = 7 mod n t ) = / <p{n) = l/ 0 (n»), 

which implies that Pr (ind s 7 = s) = l/</>(rq). Hence, 

Pr(e m | ind s 7) = Pr(ind g 7 = s ) 

e™\s,0<s«t,( ni ) 

= <j>{ni)e~ rn / (p(ni) 


which indicates that, for an integer 7 randomly selected from Z* , the probability 
that 7 is an e m -th power residue of n, is equal to e~ m . So, the probability that 
7 is an e m -th power residue of n does not exceed e~ m . □ 



New Approaches to Password Authenticated Key Exchange Based on RSA 241 

Theorem 2 demonstrates that, if there exits a prime-power of the fac- 
torization of n such that e m | then for a random number 7 G Z*, the 

probability that Alice can decrypt 7 repeatedly m times is less than or equal to 
e -m jj |q le num ber u received from Alice satisfies the equation E m {u) = u e "' = 
7 mod n, i.e., 7 is an e m -power residue of n, then Bob is ensured with prob- 
ability greater than or equal to 1 — e~ m that, for every prime-power of the 
factorization of n, e m \ (pipp*)- Since m = [log e e _1 ], e~ m < e. By Theorem 1, 
it is clear that the probability for an adversary to launch a successful e-residue 
attack against CEKEP is upper-bounded by e. 

In the protocol CEKEP, Alice proves to Bob in an interactive manner (via 
flow 2 and flow 3) that for every prime-power of the factorization of n, 
e rn \ </>(p“ 4 ). In the interactive procedure, however, only one decrypted message 
is sent from Alice to Bob. The communication overhead on Alice and Bob is 
greatly reduced in comparison with that in [271111111] • In CEKEP, the compu- 
tational burden on Bob includes two modulo exponentiations, i.e., u e mod n 
and (Act 6 ) 6 ”* mod n, where m = |"log e e -1 ]. When e < e -1 , each modulo ex- 
ponentiation has an exponent consisting of £>([~log 2 e _1 "|) bits. The computation 
time for the two modulo exponentiations is 0(2(log 2 e _1 )(log 2 n) 2 ). If e _1 <C n, 
then the computational load on Bob is greatly reduced in CEKEP in comparison 
with that in PEKEP (or in SNAPI). The parameter e determines the compu- 
tational load on Bob. It also determines the level of security against e-residue 
attacks. In practice, Bob can make a trade-off between the computational load 
and the security level offered by the protocol. When e = 2 -80 , for example, 
Bob needs to compute two modular exponentiation, each having an exponent 
of about 80 bits. In this case, the computational load on Bob is lighter than 
that in a Diffie-Hellman based password-authenticated key exchange protocol. 
In the Diffie-Hellman based EKE variant, for example, Bob needs to compute 
two modular exponentiation, each having an exponent of at least 160 bits. 


5 Formal Security Analysis 

In this section, we analyze the security of PEKEP and CEKEP within the formal 
model of security given in Section 2. Our analysis is based on the random-oracle 
model of Bellare and Rogaway [1] . In this model, a hash function is modeled as 
an oracle which returns a random number for each new query. If the same query 
is asked twice, identical answers are returned by the oracle. In our analysis, we 
also assume the intractability of the RSA problem. 

RSA Assumption: Let i be the security parameter of RSA. Let key generator 
GE define a family of RSA functions, i.e., (e, d. n) ■*— GE(l e ), where n is the 
product of two primes of the same size, gcd(e, (p(n)) = 1, and ed = 1 (mod 
For any probabilistic polynomial-time algorithm C of running time t, the 
following probability 


M\i r c sa {t) = Pr(x e = c mod n : (e, d, n) <— GE(l^), c€r {0, 1}*, x«— C(l l , c, e, n)) 
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is negligible. In the following, we use Adv rsa (t) to denote maxe { Adv£ sa (i)}, where 
the maximum is taken over all polynomial-time algorithms of running time t. 


Theorem 3. Let A be an adversary which runs in time t and makes Q S end, 
Qsend < \D\, queries of type Send to different instances. Then the adversary’s 
advantage in attacking the protocol PEKEP is bounded by 


\V\ 


~+(Qe 


t te+3 Q s 


*)Ad s, rsa (0(t))+0{^ 


+ 2 Qsend)Qoh 
2 k 


where Qexecute denotes the number of queries of type Execute and Q 0 h denotes 
the number of random oracle calls. 


We prove Theorem 3 through a series of hybrid experiments. In each ex- 
periment, we modify the way session keys are chosen for instances involved in 
protocol execution. We start by choosing random session keys (not output by 
random oracles) for instances for which the Execute oracle is called. We then 
proceed to choose random session keys for instances for which the Send oracle is 
called. These instances are gradually changed over five hybrid experiments and 
in the last hybrid experiment, all the session keys are chosen uniformly at ran- 
dom. Thus, the adversary A can not distinguish them from random. We denote 
these hybrid experiments by Pq, Pi, . . . , P 4 and by Adv(A Pf) the advantage of 
A when participating in experiment P , . The hybrid experiment Pq describes 
the real adversary attack. For 0 < i < 3, we show that the difference between 
Adv(_4. ; P,) and Adv(_/l, P )+1 ) is negligible. We bound the advantage of A in P 4 
by Qsend/\D\ + e. Hence, the advantage of A in Po (he., in the real attack) 
is bounded by Q sen d/\D\ + e. Due to lack of space, the proof of Theorem 3 is 
omitted and can be found in the full version of this paper [28]. 

It is easy to check that the protocol PEKEP satisfies the first condition of 
Definition 1. Theorem 3 indicates that the protocol PEKEP also satisfies the 
second condition of Definition 1 and hence is a secure password-authenticated 
key exchange protocol. Similarly, we can also show that the protocol CEKEP 
satisfies the two conditions of Definition 1. In summary, we have the following 
theorem 4. 


Theorem 4. Both protocols, PEKEP and CEKEP, are secure password authen- 
ticated key exchange protocols under the RSA assumption and the random oracle 
model. 

We notice that the random oracle model in Theorem 4 is less desirable than a 
standard cryptographic assumption. To avoid the random oracle model, we could 
use the proof technique of m , which require a public-key encryption scheme se- 
cure against chosen-ciphertext attacks. Unfortunately, the most commonly used 
RSA schemes (e.g. mm) which are secure against chosen-ciphertext attacks are 
also based on the random oracle model. Nevertheless, it is encouraging to see 
that efficient password-authenticated key exchange protocols with security proof 
in the random oracle model can be constructed without severe restriction on the 
public key of RSA. 
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6 Conclusion 

In this paper, we investigate the design of RSA-based password-authenticated 
key exchange protocols that do not restrict the size of RSA public exponent. 
Based on number-theoretic techniques, we develop a Password Enabled Key 
Exchange Protocol (PEKEP) which can use both large and small primes as 
RSA public exponent. We show that the protocol PEKEP is secure against e- 
residue attacks. We also provide a formal security analysis of PEKEP under the 
RSA assumption and the random oracle model. Based on PEKEP, we develop 
a computationally-efficient key exchange protocol to mitigate the burden on 
communication entities. Both protocols, PEKEP and CEKEP, do not require 
public parameters; Alice and Bob only need to establish a shared password in 
advance and do not need to establish other common parameters such as a prime 
number p and a generator g of the cyclic group modulo p. This is appealing in 
environments where entities have insufficient resources to generate or validate 
public parameters with certain properties, e.g., primality. 
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Abstract. An authenticated group key exchange (AGKE) scheme al- 
lows a group of users in a public network to share a session key which 
may later be used to achieve desirable cryptographic goals. In the pa- 
per, we study AGKE schemes for dynamically changing groups in ad hoc 
networks, i.e., for environments such that a member of a group may join 
and/or leave at any given time and a group key is exchanged without 
the help of any central sever. Difficulties in group key managements un- 
der such environments are caused by dynamically changing group and 
existence of no trustee. In most AGKE schemes proposed so far in the 
literature, the number of rounds is linear with respect to the number of 
group members. Such schemes are neither scalable nor practical since the 
number of group members may be quite large and the efficiency of the 
schemes is severely degraded with only one member’s delay. We propose 
an efficient provably secure AGKE scheme with constant-round. The pro- 
pose scheme is still contributory and efficient, where each user executes 
three modular exponentiations and at most 0{n) XOR operations. 

Keywords: dynamic authenticated group key exchange, ad hoc net- 
works. 


1 Introduction 

Recently, secure and efficient AGKE protocols have received much attention with 
increasing applicability in various collaborative and distributive group settings 
such as multicast communication, audio- video conference, multiplayer game, etc. 
In addition to provable security, the recent researches in group key exchange have 
concentrated on the efficiency which is related to the costs of communication 
and computation. Especially the number of rounds may be of critical concern in 
practical environment where the number of group members are quite large and 
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a group is dynamic. As noted in m, even in the case of a group where only few 
members have a slow network connection, the efficiency of the protocol with n 
rounds for a group of n members can be severely degraded. Furthermore, it is 
clear that a scheme with n rounds is not scalable. 

In the paper, we design a secure and efficient dynamic AGKE protocol for 
ad hoc networks m- Most group communication environments are dynamic, 
where users can join and leave a group frequently. In particular, many group key 
exchange protocols [DOdnililllHS] have considered ad hoc networks, i. e . , absent 
fixed infrastructure. IEEE 802.11 standards [TS] includes as a component an ad 
hoc network environment such as IBSS (Independent Basic Service Set). Diffi- 
culties in designing a secure and efficient dynamic group key exchange scheme 
arise from the facts that a group key should be updated whenever a membership 
changes and exchanged without any trustee. 

1.1 Overview 

Related Work: The security models and provably secure protocols for au- 
thenticated static group key exchange have been first proposed by Bresson et al. 
E3 , in which the security models have been based on the secure 2-party key ex- 
change models constructed by Bellare et al. [2j[5j[6]. Their scheme requires 0(n) 
rounds. 

Authenticated static group key exchange protocols with constant round have 
been proposed by Tzeng and Tzeng [23] and Boyd and Nieto [5]. In the protocol 
[24] with a fixed constant-round, however, the cost of communication is very 
high. Each member should compute n modular exponentiations for a group key 
exchange and additionally perform 3n modular exponentiations for authentica- 
tions, since non-interactive proof systems are used in the authentication process. 
Boyd and Nieto have proven the security of the protocol [5] in the random ora- 
cle model [I] . In [5], group members consist of one member called initiator and 
other members called responders. While the responders only perform one signa- 
ture verification, one decryption in a public cryptosystem and one operation of 
one-way hash function, the initiator has a heavy burden caused by (n — 1) en- 
cryptions in a public cryptosystem and one signature generation. Furthermore, 
both of these protocols j3[H] cannot provide forward secrecy. 

Katz and Yung have proposed a scalable authenticated static group key 
exchange protocol [19] which is based on [15] introduced by Burmester and 
Desmedt. Burmester and Desmedt’s protocol provides 2-round and more effi- 
cient computation rate of group members than previous protocols [51123]: each 
member performs 3 modular exponentiations and (^- + ^ — 3) modular mul- 
tiplications. However, Burmester and Desmedt’s protocol has not proposed any 
authentication method and any clear security proof. In [19] , Katz and Yung pro- 
pose a scalable compiler which transforms a secure group key exchange protocol 
into a secure authenticated group key exchange protocol. The compiler preserves 
forward secrecy of an original protocol. As Katz and Yung adapt this compiler 
to Burmester and Desmedt’s protocol, they construct a 3-round authenticated 
static group key exchange protocol. Each member performs the same modular 
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computations as the protocol E5I and additionally performs 2 signature genera- 
tions and (2n — 2) signature verifications. The rate of modular exponentiations 
in [TSJEH] is constant, but still the rate of modular multiplications is dependent 
on the number of group members. 

More recently, Bresson and Catalano have proposed a provably authenticated 
static group key exchange protocol with 2-round in the standard model m- 
The protocol is based on standard secret sharing techniques. The protocol is 
inefficient from a point of view of the computation rate. Each member should 
perform more than 3n modular exponentiations, 3n modular multiplications, n 
signature generations and n signature verifications. 

For dynamic groups, Bresson et al. improved the protocol m into dynamic 
group key exchange protocols in nans]. However, Bresson et al .’ s protocols do 
not have constant-round; in their schemes, each group member embeds its secret 
in the intermediate keying materials and forwards the results generated with the 
secret to the next group member. This makes the number of rounds in setup/join 
algorithms linear with respect to the number of group members. Though the 
number of rounds in leave algorithm is constant-round, for the const ant-round 
leave algorithm all members should store data of which length is linear with 
respect to the number of group members. 

Bresson et al. m have introduced a provably secure authenticated group 
key distribution protocol with 2-round in the random oracle model 0], which 
is suitable for restricted power devices and wireless environments. They have 
concentrated on an efficient computation rate of a group member with a mobile 
device. In the protocol, however, there exists a base station as a trustee. The 
computation rate of the base station is similar to the maximum rate of group 
members in other protocols without any central server; n modular exponentia- 
tions, n signature verifications, n one-way hash function operations, and n XOR 
operations. 

Our Contribution: We propose a 2-round dynamic AGKE protocol with- 
out using any trustee. All legitimate members can also detect errors and stop 
execution the protocol instantly, if invalid messages axe broadcasted by cor- 
rupted members. For dynamic group communications, we propose setup, join, 
and leave algorithms with 2-round. In the setup algorithm, each group member 
performs at most 3 modular exponentiations, 4 one-way hash function opera- 
tions, and n XOR operations. Since the operation dependent on the number of 
group members is the XOR operation, the total cost of computations can be 
highly reduced, compared to the previous protocols. For authentication, each 
group member generates 2 signatures and performs 2 n signature verifications: 
this computation rate is similar to other AGKE protocols using secure signa- 
ture schemes [T5]. Our join/leave algorithms are executed for generations of new 
session keys, whenever some members join or leave. Simply, setup algorithms of 
static constant-round AGKE protocols can be performed, whenever group mem- 
bership changes. In our join/leave algorithms, however, the communication rate 
and the total computation rate of group members are dependent on the number 
of joining/leaving members. Therefore our joining/leaving algorithms are more 
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efficient than the setup algorithms with the rates dependent on the number of 
total members, when the number of joining/leaving members is smaller than 
the number of remaining group members. With reduced round complexity, our 
protocol is still contributory, in our protocol, each member can participate in 
the generation of a group key with a one-time random value without any trust 
party. 

In Table 1, we show efficiency analysis between our protocol and Bresson et 
al .' s dynamic AGKE protocol (Bresson(Dyn)) [T3]. While the number of round 
in Bresson(Dyn) is depending on the number of group members, the proposed 
scheme is of constant round without degrading efficiency. However, our protocol 
cannot avoid the number of verification operations per each member increasing 
as like other authenticated group key exchanges [19l|24j. Our further research is 
to decrease or fix the number of verification operations. The following efficiency 
measures, Round, Communication, Message and Computation are similar to the 
measures defined by Katz and Yung in [TO] . 

— Storage: the storage rate of a member. 

— Round: the number of rounds during the execution of protocol. 

— Comm.: the maximum number of bits that a member sends during the exe- 
cution of protocol. 


Table 1. The analysis of efficiencies 


| Protocol 

Bresson(Dyn) 

Our Protocol 

Storage 

Secret- |p| , Non Secret-JV|p| 

Secret-3|M 


Round 

N 

2 

Comm. 

IV|p| + \<r\ 

|p| + 3\h\ + 2|cr| 

Mess. 

o(.n 2 )\p\ +JV|o| 

o(N)(|p| + |fa| + M) 

Comp. 

IVe + s + t; 

3e + 4/i (1ST + 1)* + 2s + 0(N)v 


Round 


2 

Comm. 

(AT+Npipl + |<r| 

|p|+3|h|+2|o| 

Mess. 

0(2VI\T.,-)|p| + 0(Nj)\<t\ 

+ |J>I + M) 

Comp. 

(N + Nj)e + 2s + Njv 

3e + 4 h+ (Nj + l)x + 2s + 0(Nj)v 


Round 

i 

2 

Comm. 

(IV - + |<T| 

|p|+3H+2|<r| 

Mess. 

(JV-JVj)|pl + |a| 

NdPl + (iV + AW|)i| + M) 

Comp. 

(2V - N e )e + s 

3e + ih + (IV + 1)* + 2s + (N e + N)v 


Notations of TabldTJ | rr | -the length of a signature, |/i|-the output size of a hash 
function, |p|-the length of a prime number p where p is an order of a cycle group G; 
iV-the number of members, Nj- the number of joining members, A^-the number of 
leaving members; s-the cost of a signing operation, v-the cost of a verifying operation, 
e-the cost of a modular exponentiation, /i-the cost of a hash function operation, x- 
the cost of a XOR operation. Note that |h| < \p\ may be satisfied in general. We do 
not consider the post computation rates in our protocol. 
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— Mess.: the total length of all bits transmitted during the execution of proto- 
col. 

— Comp.: the maximum computation rate of a member during the execution 
of protocol. 

2 The Model 

In this section we present a security model for a dynamic AGKE protocol based 
on mm by Bresson et al. and m by Katz and Yung. 

Participants. A nonempty set if is a set of users who are able to participate in 
an AGKE protocol V. Each user generates secret /public key pairs ( sk,pk ) and 
the list of all public keys are known by all users. These key pairs are long-lived 
and used for signature generation/verification. An adversary is not a participant, 
but can control all communication on a network and corrupt group members. 

Partnering. Whenever group membership changes, a new group G v = {wi, • • • , 
u n } is formed and each group member of G v can obtain a new session key sk v 
through an instance performing V: the index v increases whenever group mem- 
bership changes and Go denotes the initial group. 11/. denotes an instance j 
of a group member u, . An instance II/. has unique session identifier sid/ . and 
partner identifier pid/ . . After the group key exchange protocol V has been termi- 
nated successfully, II/. has a unique session key identifier sk/. corresponding to 
the session key sk v . pid/. corresponds to a set of group members G/. = G„\{tq}. 
When the group key exchange protocol V has been successfully terminated in 
the instance II/., each member u% of G 3 U . has an instance II// (1 < k /=i < n) 
containing {sid// , pid// , sk//} such that sid// = sid/ ., pid// = G v \ {v,k} 
and sk// = sk/ . : we state that the instances 11/ . and 11// are partnered [15] , 

Protocol Model. A dynamic AGKE protocol V consists of the following algo- 
rithms: 

— Key Generation: With an input value l fe where A: is a security parameter, 
this probabilistic polynomial time algorithm outputs a long-lived key for 
each user of U. 

— Setup(Go): This algorithm starts the protocol V and the initial group Go is 
generated. 

— Join{J , G v - 1 ): Inputs to this algorithm are a set of joining members’ identi- 
ties denoted by J and the current group G„_i. The output of this algorithm 
is a new group G v = G„_i U J and all members of G v share a new session 
key sk v secretly. 

— Leave(lZ, G„_i): Inputs of this algorithm are a set of leaving members’ identi- 
ties denoted by 1Z and the current group G„_i. The output of this algorithm 
is a new group G„ = G„_i \ TZ and all members of G v share a new session 
key sk v secretly. 
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Security Model. We define the capabilities of an adversary. We allow the 
adversary to potentially control all communication in the network via access 
to a set of oracles as defined below. We consider an experiment in which the 
adversary asks queries to oracles, and the oracles answer back to the adversary. 
Oracle queries model attacks which an adversary may use in the real system. 
We consider the following types of queries in this paper. 

— Send(II^., m): A sends a message m to an instance Ilj . When W u . receives 
m, it responds according to the group key exchange protocol. An adversary 
may use this query to perform active attacks by modifying and inserting the 
messages of the key-exchange protocol. Impersonation attacks and man-in- 
the-middle attacks are also possible using this query. 

— Setup(Go), Join (J, G v - 1 ), Leave(7£, G v - 1 ): Using these queries, A can start 
the Setup, Join or Leave algorithm. 

— Reveal(IIj.): A can obtain a session key sk which has been exchanged be- 
tween the instance W u . and partnered instances, while ufs long-lived key are 
concealed. This query models known key attacks (or Denning-sacco attacks). 

— Corrupt(iq): A can obtain ujs long-lived key. In our protocol, we consider 
adaptive corruptions m ; in general, adaptive corruptions mean weak cor- 
ruptions in which an adversary can obtain an honest member’s long-lived 
key, but cannot obtain the member’s “ephemeral” keys. 

— Test(IlJ .): This query is used to define the advantage of an adversary. A 
executes this query on a fresh instance W u . at any time, but only once (other 
queries have no restriction). When A asks this query, it receives a session 
key sk of the instance Ify, . if b = 1 or a random string if b = 0 where b is the 
result of a coin flip. Finally, A outputs a bit b' . 

To define a meaningful notion of security, we must first define freshness. 
Definition 1. An instance YV U . is fresh if both the following conditions are true 
at the end of the experiment described above: 

(a) None of the instance Ify . and its partnered instances has received an adver- 
sary’s Reveal query. 

(b) No one of u, and other members in G° Ui has received an adversary’s Corrupt 
query before adversary’s Send queries. 

Let V be a group key exchange protocol and let A be an active adversary 
against V. When A asks a Test query to a fresh instance II j in V, A receives the 
result of the coin flip b which is either a session key or a random value and then 
outputs a bit b' . If the probability that A correctly guesses the bit b is negligible, 
V is secure in the sense that A cannot obtain any information about a session 
key through re-keying broadcast messages. Let Adv^^f denote the advantage 
for A’s guess over the result of a coin-flip in a Test query with V. Then, Ad/uff^ 
is defined as follows. 

Adv^ = Pr \b' = 1|6 = 1] - Pr \b' = 1|6 = 0] = 2 Pr \b' = b\- 1. 

We say that V is a secure AGKE if Advff ,ke = ma,x{Adv ( f, al ff } is negligible. 
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For the security of authentication, we consider the ability of A for imper- 
sonation attacks against a group member Uj in an instance W u . HU- For imper- 
sonation attacks, A should be able to forge a signature of the group member 
Ui in the instance II j.. If it is computationally infeasible that A generates a 
valid signature with any message under a chosen message attack, we say that 
the signature scheme is CMA-secure. Let £ = (/C,5, V) be a signature scheme 
where JC, S and V are key generation, signing and verification algorithms. For- 
mally, let Succ^a be a success probability of As existential forgery under a 
chosen message attack against £. Then, we state that £ is CMA-secure m ^ 
Succ c ™ a = max{Succf//}} is negligible. 

A ’ 

Let G = (g) be a group. Given g x and g y , CDH problem is to compute a 
value g xy HZ]. For the CDH problem, we consider a probability Succ^ h such 
that 

Sua% dh A = Pr [C = g xy \g x , g v <— G;C <— A(g x ,g y )} , 

Sucd^b = maxjS'ucc^} 

where A is a CDH attacker against a group G. 

3 A Constant-Round AGKE Protocol 

Our protocol is based on the Computational Diffie-Hellman (CDH) assumption 
and a secure signature scheme £ = ( K,S,V ). A group key space belongs to 
{0, 1 Y where £ is a security parameter. Let G = (g) be a cyclic group of prime 
order p. g and p are public parameters and £ < \p\ is satisfied. Let H : {0, 1}* — > 
{0, 1 Y be a one-way hash function. 

Key Generation. Each user u. L of U has a private/public key pair ( sk Ui ,pk Ui ) 
for signing/ verifying. The list of public keys is published to all users. 

Setup. Let Go = {ui, • • • , u n } be an initial group. We consider a ring structure 
among the members of Go, i.e., members’ indices could be considered on the 
circulation of {1, • ■ ■ , n}. L(i) ( R(i ), resp.) means the left (right, resp.) index of 
i on the ring for i £ {1, • • • ,n}. Let Iq = ID Ul | • • • 1 1 D Un . Figure Q] shows the 
example of this algorithm with four members. 

— Round 1. Each member u* randomly chooses fy £ {0, ify and Xi £ Z*, 
computes y 7 ; = g Xi and keeps fc ? ; secretly. The last member u n computes 
H(k n 1 10). Each member u* generates a signature aj = S s k u . (M/| | Jo| |0) where 
Mf = yi for 1 < * < n — 1 and M l = T-L{k n \\t))\\y n , and broadcasts Ml\\aj. 

— Round 2. All members receive (M/| |er|)’s and verify a] ! s. If some signatures 
are not valid, this process fails and halts. Otherwise, Uj computes tf = 
M&^IIIollO), tf = W^H/ollO) and generates fy = tf © tf . The last 
member u n additionally computes T = k n © tf . Each member generates 
of = S s k u .(Mf ||Io||0) and broadcasts Mf ||of where Mf = fy||Tj for 1 < i < 
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Fig. 1. Setup algor 


thm with Go = {mi,«2,M3,W4} 


- Key Computation. Session Key Computation: All members verify 
signatures of ’s. If all signatures are valid, u* computes t^ +l) t^ +2 , • • ■ , („_i) 

(= tf) by using tf: 


t? +1 = T i+1 © tf , tf +2 = T i+2 © 


Finally u,; can check if tf = tf holds. Even though wrong messages (or no 
message) are broadcasted by illegal members or system faults, honest mem- 
bers can notice the errors through the above check process and then halt the 
protocol. However, it is not easy to find who transmitted illegal messages. 
When members want to find illegal members, all members participating in 
this protocol should reveal their secret values x^s. If the above check process 
has been valid, all members have (= ) . Then they can obtain k n from T 

and check if H(k n ||0) = H(k n ||0) holds. Note that Key Control can be guar- 
anteed by this check value and the one-way hash function Tl. All members 
compute a session key like as 

sk 0 = H(k 1 \\k 2 \\---\\k n - 1 \\k n \\0). 

Post-Computation: Each member generates hf = |sfc 0 ||0), 

hf = |sfco||0) and X = W(A:„||sA:o||0) and saves (hf,hf,X,sko) 

secretly. All members should erase other ephemeral data. 

Join. Let G v -\ = {ui, • • • , u n } ( v > 1) be the current group and J = {u n+ i, ■ ■ ■ , 
Un+n'} ( n ' > 1) be a set of new members. We divide G v -i into three parts 
{«i}, {u- 2 , ■ ■ ■ ,u„_i} and and consider u 2 as an agent of {u 2) ■ ■ ■ ,u„_i}. 

For convenience of explanation, we allow that u n+n > + i, it n+n ' + 2 and u n+n > + s 
denote m, u% and u n . In this algorithm, we consider a ring structure among 
the members u n+ 1 ,--- , u n+n / + 3 . Let Q be the set {u n +i,--- , u n ^ n i + ^} and 
I v = ID Ul || • • • || ID Un+n ,. Figure [2] shows the example of this algorithm. 
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{«!,%%#; J = {u »,<«}, h =/n„ l ||in„||/n„ s ||/D„ 4 ||/D„ s ||rn„ 



Fig. 2. Join algorithm with U2, 113, 114} and J = {us,W6} 


— Round 1. Each member u n+ i of Q randomly chooses k n+ i € {0, 1 Y and 
x n+ i e Z*, computes y n +i = g Xn + i and keeps k n+ i secretly. The member 
u n+n ' + 2 (= U 2 ) computes y n + n '+ 2 = g x by using the secret value X instead 
of x n+n ' + 2 and the member u n+n > + 3 (= u„) computes H(k n+n < + 3 \\v). Each 
member u n+ i generates = S s k u . (M^ +i \\I v \\v) where M* +i = y n +i 
for 1 < i < n' + 2 and M^ +n , +3 = H(k n . 3 1 1 »••) y,,-,,'^ and broadcasts 

Mn+ilWh+i- . 

— Round 2. All members receive (M* +i | |< 7 „ +i )’s and verify <j„ + >’s. Each mem- 
ber u n+i computes t% +i = kL{y X j^ +i) \\I v \\v), t% +i = kl{y X x l £' +i) \\I v \\ v ) and 
generates T n+i = t^ +i ® t^ +i . The member «„ + „/ +3 additionally computes 
T = k n+n ' + 3 ®t^ +n , +3 . Each member u n+ i generates a^ +i = S s k Un+ . (M% +i \\ 
I v \\v) and broadcasts M^ +i \\a^ +i where M% +i = k n+i \\T n+i for 1 < i < 
n' + 2 and M% +n , +3 = T||T„ +n / +3 . All members of {u 3 , • • • , u„_i} compute 
t-n+n'+i an d t ^ +n , + 2 by using X. 

— Key Computation. Session Key Computation: All members verify 
<r^ +i ’s. If all signatures are valid, each member u n+ i computes t^+i+i » ' ' ' > 
tn+i+ n '- i( = t%+i) by using t„ + i and checks if t^ +i = t% +i holds. Also, the 
members u 3 , • • • , u n - 1 can check it by using t^ +n , +2 and t^ +n , +2 - Finally all 
members can obtain fc n+n / +3 from T and compute a new session key sk v as 
follows: 

sk v+1 =H(k n+1 \\---\\k n+n ' + 3 \\v). 

Post-Computation: Each new member u n+ i (1 < i < n') generates h^ +i = 
kC{y X j^ +i2) \\ s k v \\ v ) and h^+i = W{y X j^ +fj \\sk v \\v). u\ and u n respectively 
compute = H{y^ +n , \ \sk v | |n) and = 'hL{Vn +\ 1 |sfc„ | |n) instead of the pre- 
vious value (= hn ). All members compute a new value X = H(k n \\sk v \\v) . 
Each member it,; saves hf, hf , X and sk v secretly. 
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Leave. Let G v -\ = {ui,U 2 , • • • , u n } be the current group and 1Z = { u ,ui 2 ,- ■ ■ , 
u i n ,t } with {?i, • • • , l n "} c {1, 2, • • • , n} be a set of revoked members. Let 
beaset of all left /right members of revoked members, be., Af(1Z) = {u^- i,uz 1+ i, 

■ • • , ui n „-i,ui n „ + i}. For generating a new group G v = G v -j \1Z with a new ses- 
sion key s v , a new Diffie-Hellman value should be shared between two mem- 
bers Uij - 1 and Ui j+ i (1 < j < n"). In this algorithm, we consider a ring 
structure among members of G v and we newly index the members as G v = 
{tti,U2, • • • ,u n - n "}- Let I v = ID n i|| • • • \\ID n _ n " . Figure [3] shows the example 
of this algorithm. 



Fig. 3 . Leave algorithm with G„_i = {mi, M2, M3, W4, Ms, Me} and 1 Z = {113, Ms} 

— Round 1. Each member u w of Af(lZ) randomly chooses k w £ {0, 1}^ and 

x w £ Z*, computes y w = g x '“ and keeps k w secretly. The member uj n „+i 
computes H(ki n „ + i||u). u w generates = S s k Uw (M^||I„||u) where M ^ = 
y w with w € (Ii - l,/i + 1, • • • ,l n " ~ 1} and = 'H(ki ri „ + i\\v)\\yi n „ +1 , 

and broadcasts M,}||erfy 

— Round 2. All members of G v verify signatures ofy.’s. If all signatures are 

valid, each member (resp. ui J+ 1) of Af (71) regenerates hf._ 1 = y tj 3 + i 

(resp. /if +1 = j/j Vf ). Then each member it* of G v computes tf =H(hf\\I v \\v), 
tf = H(hf\\I v \\v) and T t = t( J 8 tf. The member Ui n „+i additionally 
computes T = h n „ + i ® tf n+1 . Each member u t generates a signature 
of = S sku .(M?\\I v \\v) and broadcasts M?||of where M^ /;+1 = T\\Ti n , l+1 , 
Mf = ki\\Ti for other members except u; n „+i of N {TV) and M? = T, for 
members of G v \Af(1Z). 
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- Key Computation. Session Key Computation: All members verify sig- 
natures of’ s. If all signatures are valid, each member u,; computes tj+i , 

• • • , *i+( n -n"-i)( = *?) by using tf. Finally, each member tq checks if if = if 
holds. Then all members computes a session key as follows: 

sk v = W(fc Zl _! ||fc, 1+ i|| • • - 1 Im- 

post-Computation: Each member m, regenerates /if = Ti.(hf\\sk v \\v), 
hf = H{hf\\sk v \\v) and X = H{ki n „ + \\\sk v \\v) and saves /if, /if, W and 
the session key secretly. 


4 The Security 

In this section, we prove the security of our protocol in the random oracle model. 


4.1 Security Proof 

The security of our protocol V is dependent on the probabilities Succ c ™ a and 
SuccQ h , since an adversary A against V can obtain information about a ses- 
sion key only by two methods: A successfully performs either signature forgery 
attacks or CDH attacks. Even if random values kfs were selected identically in 
different instances, A could not get any information about a session key because 
of the index v and the random hash oracle hi. Our proof method is similar to 
that in [14] . 

Theorem 1 . Let A be an active adversary against our protocol V in the random 
oracle model. Let q s be the number of Send queries and qn be the number of 
queries to the hash oracle hi. Then, 

Adv^p ke < 2 n • Succ c ™ a (t , q s ) + 2 qnQ% ■ SucC(f h (t) 

where n is the maximum number of group members and t is the adversary’s 
running time. 

Proof. We consider *4’s attacks as a sequence of simulated protocols, which is 
denoted by a sequence of games {Game 0 , ■ • • , Game 3 }. In each game, A executes 
Test query and get a result of a coin flip b. Each Succ, denotes an event in which 
.4’s a guessing bit b' is equal to b in each Game,;. Each Game, is simulated as 
follows: 


Gameo: This game is equal to the real protocol V. All group members obtain 
a pair of valid signing/ verifying key and randomly choose kf s and xfs. In this 
game, .A’s advantage is equal to the advantage in the real protocol V. Thus, 


Pr [Succ 0 ] = 


Advlp^ + 1 

2 


(1) 


Gamei: In this game, we consider a special event SigForge in which A executes a 
Send query with a message m instead of a group member Ui in an instance Ilf. 
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and the message is verified and accepted by all group members. In particular, the 
message to previously has not been used in any instances and a Corrupt(uj) query 
has not been executed to the member tq. When the event SigForge occurs, this 
game halts and A’s output b' is determined randomly. The difference between 
A’s outputs in games Gameo and Gamei is dependent on the event SigForge. 
That is, 


|Pr [Succi] — Pr [Succ 0 ]| < Pr [SigForge] . 

If one correctly guesses a member impersonated by A and the event SigForge 
occurs to the member, one can be successful in the existential forgery against a 
pair of signing/verifying key under CMA. Therefore we know that 

Succ c ^%(t, q s ) > ^ Pr [SigForge] . 

Finally, we get 

|Pr [Succi] — Pr [Succ 0 ] | < Pr [SigForge] < n ■ Succ c ^f%(t, q a ) (2) 

Game 2 : In this game, a Difffe-Hellman triple ( A = g a , B = g b ,C = g ab ) is given. 
Whenever two successive members iq and tq+i should choose random values x* 
and Xi+i and compute y,; = g Xi and y l +i = g Xi+1 , we simulate this game with 
yi = A Ci and y^ +1 = B Ci+1 where c* and Cifi are random values in Z*. Then a 
hash value tf (= tf +1 ) is computed by using C CiCi +' . We know that this game 
is equal to Gamei as long as Cj and c i+1 are selected randomly. Therefore, 

Pr [Succ 2 ] = Pr [Succi] (3) 

Games: In this game, a pair ( A = g a , B = g b ) is given and there is no information 
about the Difffe-Hellman value C = g ab . Whenever two successive members iq 
and iq + 1 should choose random values x., : and aq+i and compute y* and y*+i, 
we simulate this game like Game 2 - However, when u t or tq + i should broadcast 
a message with a hash value tf (= tf +1 ), a random value r in {0, l} e is used as 
the hash value. Now, we consider an event Flash in which A detects the fact that 
the broadcasted hash value tf (or tf +1 ) is incorrect by using A’s hash oracle 
queries. This event is possible when A sends a correctly guessing value C CiCi+1 
to the hash oracle H and receives a hash value. At that time, A recognizes that 
the value is different from the previous random value r. When the event Flash 
occurs, this game is halted and A’s output b’ is randomly chosen. Therefore, 

[Pr [S11CC3] — Pr [Succ 2 ] | < Pr [Hash] . 

Given (A, B) one can obtain a valid Difffe-Hellman value C if both of the 
following situations occur; (1) two successive members compute y,; = A Ci and 
Di + i = B Ci+1 and use a random value r as a hash value tf, (2) A executes a 
hash oracle query with a correctly guessing value C CiCi+1 after (1), i.e ., the event 
Flash occurs. Therefore 


Succ c G dh A (t) > ^ Pr[Hash], 
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Finally, we get 

|Pr [Succ 3 ] — Pr [Succ 2 ]| < Pr [Hash] < qn'/i • Succ'^\{t) (4) 

Furthermore, A has no advantage for guessing a coin-flip bit b in this game 
since the hash oracle H has been supposed the random oracle and each input of 
the hash oracle is used only once owing to the index v. Therefore Pr [Succ 3 ] = |. 

From the above results, the theorem is proved. □ 


4.2 Forward Secrecy of AGKE Protocol 

For a secure group key exchange protocol, forward secrecy is one of essential 
security requirements. Forward secrecy means that the compromise of one or 
more members’ long-lived keys should give no information for the compromise 
of any earlier session key. 

In an AGKE protocol, a member’s long-lived key is the member’s signing key 
for authentication. Most dynamic AGKE protocols have considered an adversary 
with weak corruption ability and have guaranteed forward secrecy for a mem- 
ber’s signing key. Bresson et al.’s protocols pT^HTT?] have offered forward secrecy 
for a member’s signing key. However, another secret value of a member (really, 
it is an exponent) is as important as a signing key. If a member’s exponent is 
revealed, earlier session keys can be revealed as well as later session keys. Fur- 
thermore, unless a member is a leader of a group, the member’s secret exponent 
key never changes from joining to leaving. Therefore the secret exponent should 
be definitely considered as a long-lived key, even though the value is saved in a 
smart card. Also, in Bresson et al. m , forward secrecy for a member’s signing 
key can be guaranteed, but forward secrecy for a member’s Diffie-Hellman value 
cannot be guaranteed: a member’s DifRe-Hellman value is never changed until 
the member leaves. Therefore this value should be also considered as a long-lived 
key. 

In our AGKE protocol, a member secretly keeps a signing key as a long- 
lived key and three hashed values as short-lived keys: every time a session key is 
changed, member’s short-lived keys are also changed. In the paper we consider 
and prove forward secrecy for member’s long-lived key, but our protocol also 
guarantees forward secrecy for member’s short-lived keys. When an adversary 
obtain some members’ short-lived keys, it can obtain later session keys, but 
cannot obtain previous session keys easily. Therefore our protocol can guarantee 
forward secrecy against an adversary with strong corruption capability m in 
which an advasary can obtain a member’s short-lived key as well as the member’s 
long-lived key. 

5 Conclusion 

We have proposed an efficient and secure constant-round AGKE protocol for 
dynamic groups in the random oracle model. We note that each membership 
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change in dynamic group could be handled by running other constant round 
static AGKE protocols from scratch. But our Join and Leave algorithms are 
more efficient than Setup algorithms of other constant round AGKE protocols 
for static groups when the number of joining/leaving members is smaller than the 
number of remaining group members. Hereafter, research in a provably secure 
constant-round AGKE protocol for dynamic groups under standard assumptions 
should be studied. 
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Abstract. We propose a public- key traitor tracing scheme in which (1) 
the size of a ciphertext is sublinear in the number of receivers and (2) 
black-box tracing is efficiently achieved against self-defensive pirate de- 
coders. When assuming that a pirate decoder can take some self-defensive 
reaction (e.g., erasing all of the internal keys and shutting down) to es- 
cape from tracing if it detects tracing, it has been an open question 
to construct a sublinear black-box traitor tracing scheme that can de- 
tect efficiently at least one traitor (who builds the pirate decoder) with 
overwhelming probability, although a tracing algorithm that works suc- 
cessfully against self-defensive pirate decoders itself is known. In this 
paper, we answer affirmatively the above question by presenting a con- 
crete construction of a public-key black-box tracing scheme in which the 
known tracing algorithm can be used while keeping the size of a cipher- 
text sublinear. 

Keywords: Public-key traitor tracing, Black-box tracing, Self-defensive 
pirates. 


1 Introduction 

Consider content distribution (e.g., pay-TV) in which digital contents should be 
available only to subscribers. A data supplier broadcasts an encrypted version 
of the digital contents (e.g., a movie) to subscribers, and only subscribers can 
decrypt them with their decryption keys given in advance. In this application, 
malicious subscribers may redistribute their decryption keys to non-subscribers. 
This piracy is serious since it allows the non-subscribers to have illegal access to 
the contents. 

To prevent the piracy, traitor tracing [3] has been studied extensively. In 
traitor tracing, each subscriber is given a distinct decryption key ( personal key ) 
which is contained in a decryption device (decoder), and the data supplier broad- 
casts both the contents encrypted with a session key and the encrypted session 
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key {header). The subscribers can obtain the session key (and consequently the 
contents) by inputting the received header to their decoders. In this scenario, 
malicious subscribers {traitors) may give away their personal keys to a pirated 
version of a decoder {pirate decoder ) . Once the pirate decoder is found, at least 
one of the traitors who join the piracy can be identified from it. A traitor trac- 
ing scheme discourages traitors from committing the piracy since the confiscated 
pirate decoder can be traced back to its producers. 

Among traitor tracing schemes, our interest is in a black-box tracing scheme 
in the public-key setting. In black-box tracing, a tracer does not break open 
the pirate decoder but uses it as a black box. Briefly, the tracer chooses a set 
of suspects and tests whether traitors are included in it only by observing the 
behavior of the pirate decoder on chosen inputs. Since traitors can be identified 
no matter how the pirate decoder is implemented, it is desirable to support 
black-box tracing. In the public-key setting, there are one or more public keys 
and subscribers can decrypt the header by using their personal keys. Since no 
secret information is needed to build the header and to execute the tracing 
algorithm, anyone can work as a data supplier and/or a tracer. This property is 
desirable as well because of the following two reasons: (1) it enhances the sender- 
scalability in the sense that plural data suppliers can use the same system and (2) 
it provides public verifiability of the tracing result, which is a stronger deterrent 
to the piracy. 

As a public-key black-box tracing scheme, the schemes of [312] are known Q 
While these are efficient in the sense that the size of a personal key is constant 
and that of a header is linear only in the maximum number of traitors in a 
coalition, the running time of the tracing algorithm is exponential in the max- 
imum coalition size, hence impractical. The convergence time for the tracing 
algorithm is improved to be practical in the schemes of 0E] by integrating the 
mechanism of revocation of any number of subscribers into black-box tracing. 
However, if it is assumed that a pirate decoder can take measures (e.g., it erases 
all of the internal keys and shuts down once it detects tracing) that might escape 
from tracing, tracing is impossible since the identities of suspects are revealed 
in the inputs for black-box tracing. In this paper, we consider this type of pirate 
decoders. 

1.1 Our Result 

We explain our contribution by comparing previous schemes against self-defen- 
sive pirate decoders with ours. (See Table [lj) As mentioned above, in the scheme 
of [lH] the tracer can only do black-box confirmation in which the number of 
suspects examined in one test has to be limited to k, where k is the maximum 
coalition size. Therefore, the black-box confirmation algorithm needs to be exe- 
cuted on all of the possible (£) sets of suspects in the worst case, where n is the 
total number of subscribers. This results in an impractical tracing algorithm. 
Note that there is a trade-off between the running time of the tracing algorithm 


The scheme of [7] is improved in [Tolls]. 


262 T. Matsushita and H. Imai 


Table 1. Summary of our result (n: the total number of subscribers, k\ the maximum 
coalition size, c: a constant (0 < c < 1)) 



Personal- 

Header size 

# of sets of suspects 
required for tracing 

Type of tracing 

mm 

0(1) 

0(k ) 

o 

Black-box confirmation 

m (c = 1 / 2 ) 

0(1) 

0(Vn) 

y/n 

Black-box list-tracing 

Ours ( k = y/n/ 8) 

0(1) 

0(Vn) 

n 

Black-box tracing 


and the transmission overhead. For instance, if we set k = to— 1, then the number 
of sets of suspects required for tracing is reduced to n, but the size of a header 
is linear in n, hence inefficient. It has been an open question to obtain a traitor 
tracing scheme with both practical black-box tracing and sublinear header size, 
as pointed out in [2]. 

In (B], a partial solution to this question is presented by introducing a re- 
laxation idea called as list-tracing in which the output of the tracing algorithm 
is a set of suspects, i.e., a suspect list, and it is guaranteed that at least one 
traitor is included in it. The scheme of [B] is based on that of [3] and achieves 
both practical black-box list-tracing and sublinear header size. Unfortunately, 
this approach incurs another trade-off between the size of the suspect list and 
that of a header. In order to reduce the header size the suspect list needs to be 
larger, but the probability that the tracer detects a traitor correctly is in inverse 
proportion to the size of the suspect list, if the tracer attempts to identify the 
traitor only from the suspect list. 

In this paper, we solve the open question without the list-tracing approach. 
By applying the key-generation method of [5] to the scheme of (S], a sublinear 
public-key black-box tracing scheme against self-defensive pirate decoders can be 
obtained. Note that the improvement we achieve is not in the tracing algorithm 
itself but in a concrete construction of a public-key black-box tracing scheme in 
which the known tracing algorithm that can identify at least one traitor with 
overwhelming probability from the self-defensive pirate decoder can be used 
while keeping the size of a header sublinear. 

The rest of the paper is organized as follows. In Sect. [2j the assumptions on the 
pirate decoder are described. We propose a sublinear public-key black-box tracing 
scheme in Sect. [3] The proposed scheme is analyzed in terms of security and effi- 
ciency in Sect. S] and Sect. [5] respectively. We present our conclusions in Sect. [B] 

2 Assumptions on Pirate Decoders 

Let a valid input denote a header for the normal broadcast and an invalid input 
denote a header for black-box tracing. In this paper, we make two assumptions 
on the pirate decoder. 

Assumptions 1. The pirate decoder can take measures that might escape from 
tracing if it detects tracing. 
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In Assumption Q] the pirate decoder outputs the correct plaintext only when 
it gets a valid input or an invalid input which is indistinguishable from a valid 
one. If the pirate decoder detects that it is examined in the tracing process, it 
will evade tracing by, e.g., erasing all of the internal keys and shutting down. As 
well as such self-defensive reaction, the pirate decoder can take aggressive coun- 
termeasures (e.g., crashing the host system or releasing a virus) as described in 
[6]. Note that (1) for simplicity we assume that the reaction is triggered deter- 
ministically, i.e., it is activated once the pirate decoder detects tracing and (2) 
our scheme can be easily extended to the general probabilistic case. In order 
to identify efficiently traitors from the pirate decoder with the reaction mech- 
anism, it is necessary that a tracing algorithm can decide at least one traitor 
immediately when the reaction is triggered. 

Assumptions 2. The tracer can reset the pirate decoder to its initial state each 
time the tracer gives the input to it. 

Assumption [2] means that each test during black-box tracing can be done 
independently. We do not consider the pirate decoder that records the previous 
inputs submitted by the tracer and reacts based on its record. 

The pirate decoder assumed in the paper can be viewed as a type-2 pirate 
decoder categorized in [B] . 

3 Proposed Scheme 

First, we describe an outline of the proposed scheme. Secondly, an explicit con- 
struction of our scheme is shown. 

3.1 Outline 

Our scheme consists of the four phases. 

Key Generation: A trusted party generates and secretly gives every subscriber 
a distinct personal key. The personal key is stored in the decoder. 

Encryption: The data supplier encrypts (1) the contents with the session key 
and (2) the session key itself as a header. Then, the data supplier broadcasts the 
encrypted contents and the header. To avoid complication, we assume that (1) 
a symmetric encryption algorithm used for encryption of the contents is secure 
and publicly known and (2) a broadcast channel is reliable in the sense that the 
received information is not altered. 

Decryption: When receiving the header, subscribers compute the session key 
(and consequently the contents) by inputting it to their decoders. 

Black-Box Ttracing: Suppose that the pirate decoder is confiscated. In the 
jth test, the tracer chooses a subscriber, Uj, and builds the header in which the 
subscribers, U\. , Uj, are revoked and the others are not, where ui, . . . , Uj- 1 
has been selected in the (j — l)th test. The tracer inputs this header to the pirate 
decoder and observes whether it decrypts correctly or not. If its output is (1) 
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correct on the input where a set of revoked subscribers is X and (2) incorrect 
on the input where a set of revoked ones is X U {«}, then the tracer decides that 
the subscriber, u, is a traitor. 

3.2 Protocol 

Let n be the total number of subscribers and k be the maximum number of 
traitors in a coalition. Let p, q be primes s.t. q\p — 1 and q > n + 2k — 1. Let g 
be a gth root of unity over Z* and G q be a subgroup of Z* of order q. Let U be 
a set of subscribers ( U C Z g \{0}). All of the participants agree on p. q, and g. 
The calculations are done over Z* unless otherwise specified. 

Key Generation: The key-generation method is similar to that of [9] . Split U 
into i disjoint subsets U o, . . . Ml- 1 - These subsets are publicly known. Choose 
o 0 , . . . , a 2 k-i,bo, ■ ■ ■ , be - 1 Gr Z f; . Then, compute the public key e as follows: 

e = (s, 2 / 0 , 0 ) ■ • • , 2/o, 2 fc-i, 2/i,o, ■ ■ • , 

= (9, 9 a ° , ■ ■ ■ , g a ‘ 2k ~ 1 ,g bo ,..., g**- 1 )- 

Suppose that u G U % . The subscriber ids personal key is (u, i, /*(«)) where 
2fe-l 

fi( u ) = ai ti u ^ m0( i 9, 

3= 0 

_ . (j / femod 2k), 

1 h ( j = i mod 2k) . 

Encryption: Select the session key s Gr G q and random numbers Ro, Ri Gr Z 9 . 
Build the header H — (Mo , . . . , He- 1 ) by repeating the following procedure for 
0 < i < I — 1. 

— Set Vi = Ro or f?i, and compute Hi as follows. 

Hi = (hi, hifi, ■ ■ ■ , hi t 2k- 1), 
hi = g ri , 

h ,._ j vZj (j/«nod2 fc), 

1,0 \ sy r i t i (j = * mod 2k). 

Note that all of the subscribers in lAi can be revoked by replacing with 
g Zi where Zi Gr Z q is a random number. 


Decryption: Suppose that u G U-i. The subscriber u can correctly compute the 
session key s from Hi as follows. 
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Black-Box Tracing: The black-box tracing algorithm is based on that of [8]. 
The difference is that while in [8] suspects must be narrowed down to k sub- 
scribers before the execution of black-box confirmation, in ours no such prepro- 
cessing, which rims in exponential time, is needed. The inputs of the tracing 
algorithm are Uo, . . . ,Ut-i and the pirate decoder, and the output is a traitor’s 
ID. 

For simplicity, we assume that \Uq\ = • • • = \Ut-\\ = 2k, l = n/2k, 2k\n. 
Label all of the elements in Uo, . . . ,Ui-\ as follows. 

Uo = {til, ■ • • , «2fc}, 

U\ = {li2fc+l, . • - , Uik}, 

Ut - 1 = {u n _2fc+l, • ■ ■ , u n }. 

For 1 < j < n, repeat the following procedure. 

— Set ctrj = 0 and then repeat the following test m times. In each test, the 
session key s and random numbers Ro, Ri are chosen randomly. 

1. Set X = {u\, . . . ,Uj} and build the header H = (H 0 , . . . , by 

repeating the following procedure for 0 < i < £ — 1 . The same notations 
are used as in the encryption phase and a random number Zi £r Z g is 
selected randomly in each time. 

- If there exists a subset U t (0 < t < i — 1) s.t. X n U t / 4 and 
X D U t / Ut, then first, suppose that U t \X = {mi , . . . , x w } and 
choose 2k — w — 1 distinct elements a; lJJ+ i, . . . , X 2 k-i Gr Z f; \(WU 
{0}) when 2k — w — 1 > 0. Secondly, find Co, . . . , cafc-i G Z 9 s.t. 
c j x a = 0 m °d Q for 1 < Q < 2fc — 1 . Finally, compute H t as 

follows. 

k = g R \ 

h . = { 9 Cj yo,i (j / ^ mod 2 k), 

t ' J \ sg c ’yk t (j = t mod 2k). 

For i / ^ set r* = Rq if X n Ui = 0. Otherwise (X nUi = U t ), set 


rt = Rq or R 1 . Then, compute Hi as follows. 

hi = g ri , 



( j / «=mod 2k, Ti = Ro), 

h - \ y Cj yoj 

(j / «nod 2k, Ti = i?i), 

(j = i mod 2k, X D Ui = 0) , 

[g Zi 

(j = i mod 2 k,XnUi=Ui). 

Otherwise [X C\Ui = 0 or 

X C\Ui = Ui for any i), Hi is the same 


in the encryption phase. 
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2. Give H to the pirate decoder and observe its output. 

3. If it decrypts correctly, then increment ctrj by one. (If a self-defensive 
reaction is triggered, then decide that the subscriber Uj is a traitor.) 

Finally, find an integer j G {1, . . . , n} s.t. ctrj - 1 — ctrj is the maximum and 
then decide that the subscriber Uj is a traitor, where ctro = m. 


4 Security 

The security of our scheme is based on the difficulty of the Decision Difhe- 
Hellman problem (DDH) pQ. Informally, the assumption that DDH in G q is 
intractable means that no probabilistic polynomial-time (p.p.t. for short) algo- 
rithm can distinguish with non-negligible advantage between the two distribu- 
tions {51,52,5“, 5f) ail d (51,52,51,52) where 51, 52 Gr G q and a,b Gr Z q . We 
call a 4-tuple coming from the former distribution as a Diffie-Hellman tuple. Let 
Ad DDH be a p.p.t. algorithm which solves DDH in G q . For two p.p.t. algorithms 
•Mo, -Mi, we mean by Ado => Adi that the existence of Ado implies that of Ad] 
and by Ado Adi that Ado => Adi and Adi => Ado- 

4.1 Indistinguishability of a Session Key 

Theorem 1 (Indistinguishability of a Session Key). When given a header, 
the computational complexity for the non-subscribers to distinguish the session 
key corresponding to the header from a random element in G q is as difficult as 
DDH in G q . 

Proof. Let Ad^ lst be a p.p.t. algorithm the non-subscribers use to distinguish 
between the session key corresponding to the header and a random element in 
G q . We prove that Ad£ ist o Ad DDH . First, it is clear that Ad DDH =G Ad£ ist . 
Secondly, we show that Ad^ lst => Ad DDH by constructing Ad DDH using Ad^ Ist as 
a subroutine. The construction of Ad DDH is as follows. 

Algorithm 1 (P.p.t. Algorithm Ad DDH ). 

Input: a challenge 4-tuple, (51, 52, 53, 54)- 
Output: “Diffie-Hellman tuple” or “Random tuple.” 

Step 1. Choose a set of subscribers U (C Z g \{0}) and split U into l disjoint 
subsets Zdo, . . . -Llp-y. For 0 <i < £— 1 , 0 < j < 2k — 1, choose random numbers 
p,Xi,aj Gr Z q and compute the public key e = (51,5“°, ■ ■ • ,5i 2fe_1 ,5i°, • • • , 
51*” 1 ) where g h f = g^glf. 

Step 2. Select the session key s Gr G q and a random number r Gr Z q . Compute 
the header H = (Hq. . . . , H^-f) by repeating the following procedure for 0 < i < 
l- 1. 
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— Set Bi = 0 or 1 and compute H, as follows. 


h = gi ir 93, 


(rf"*.)”' 

» i<h '' <ri) f 


(j / «nod 2k), 
(j = i mod 2k) . 


Observe that if the challenge 4-tuple is a Difhe-Hellman tuple, the session 
key corresponding to the header is s. Otherwise, it is a random element in G q . 
Step 3. Give s,H,e to Af^ Ist . If M^ st decides that s is the session key corre- 
sponding to H, then output “Difhe-Hellman tuple.” Otherwise, output “Random 
tuple.” Since M^ st behaves differently for session keys and random elements in 
G g , At DDH can solve the given DDH challenge. This completes the proof. □ 


4.2 Black-Box Traceability 

Recall that valid and invalid inputs denote headers for the normal broadcast and 
those for black-box tracing respectively. In our tracing algorithm subscribers in 
X are revoked in invalid inputs. The following three lemmas are used to prove 
black-box traceability of our scheme. 

Lemma 1 (Indistinguishability of an Input). The computational complex- 
ity for any coalition of k non-revoked subscribers to distinguish a valid input 
from an invalid one is as difficult as DDH in G q . 

Proof. Let C be a set of k non-revoked subscribers in a coalition and Vq be a 
p.p.t. algorithm the coalition C uses to distinguish a valid input from an invalid 
one. We prove that T>* st <*=> At DDH for any C with X fi C = 0 , \C\ — k. First, it 
is clear that Af DDH => D^ lst for any C with X fiC = 0 , \C\ = k. Secondly, we 
show that X>£ lst => At DDH for any C with X fl C = 0 , \C\ = k by constructing 
At DDH using X>c' st as a subroutine. The construction of M DDH is as follows. 

Algorithm 2 (P.p.t. Algorithm A4 DDH ). 

Input: a challenge 4-tuple, {g\,gi,g 3 ,gf)- 
Output: “Difhe-Hellman tuple” or “Random tuple.” 

Step 1. Choose a set of subscribers U (C Z,\{0}) and split U into t disjoint sub- 
sets Uo, ■ ■ ■ Mt-i- Select a set of revoked subscribers X (C U) with a condition 
that there is at most one subset Ui (0 < i < i — 1) s.t. Ui 0 X / Ui fl X / Hi. 
Then, choose a set of k colluders C s.t. X fl C = 0 . 

Step 2. Suppose that C = {ar, . . . , Xk}- Choose k — 1 distinct elements Xk+ i, . . . , 
% 2 k-i £r \ C and random numbers /3i, . . . , /3fc, A, p, Sr for k + 1 < 
t < 2k — 1. Then, there exists a unique polynomial a(x) = J2m=o a mX m mod q 
S.t. gf° = gfg% and 
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(a(®i), . . . , a{x 2 k-\)) T = (Pi, • • • , fak-ij 1 

= (a 0 , . . . , ao)' 1 ’ + V(ai, . . . , a 2i: _i) T mod q, 
gf ‘ = gpg 1 ? 1 (k + 1 < t < 2k — 1), 


where 

( X! . . . Xi k_1 \ 

: • • . : mod q. 

X2k-1 ■ ■ ■ x 2k-l / 

Since V is the Vandermonde matrix, we obtain 

(«!, . . . , a 2 fc_i) T = V _1 (/3i - a 0 , • • • i p2k—i ~ ao) T mod q. 

Let (v m> i, ■ . . , Vm,2k~l) be the mth row of V -1 . For 1 < m < 2k — 1, a m is 
represented as follows. 

Oi m = »m, l(Pl — OL o) + 1- t>m,2fe-l(/32fc-l — OL o) 

= V m ,ij3i H 1- V m! 2k-Ip2k-1 - O!o(«m,i H 1- v m ,2k-i) mod q. 

Therefore, g° m is calculated as follows. 

a m \-V m ,2k-l/32k-l / t A \~ v m,2k — l 

9i =9 1 / {9i92) 

Suppose that Xj £ (1 < j < k, % € {0, . . . ,£ — 1}) and define J = 

{ij |1 < j < k, xj £ liij). Choose random numbers Aj, //j Gr Z g for 0 < i < i — 1 
and Sij Gr Z g for all fy’s in J . Then, there exists a unique element 7q. G Z g for 
each ij £ J s.t. 


% = bij + lij ~ Olij m od 2 k (ij 6 J), 

9i' = 9 i'92* (0 < i < t — 1). 

We plan to compute the subscriber Xj’s personal key ( Xj,ij,dj ) as follows. 

dj = a(xj ) + bijX 1 ? mod 2k 

= ao + ai Xj H h Oq.afy H b a 2 fc_i Xj + 7 ^x- 

To satisfy dj = fi } ( x y) where / is the key-generation function defined in 
13.21 the coefficients ao, . . . , a 2 fc_ 1 are represented as follows. There are at least 
k elements in {0, . . . , 2k — 1} \ {ij mod 2k\ij £ J} and we can select k such 
elements . . . , Ok- Then, compute g 1 9l , . . . , g 1 Bk s.t. 


= 9i ' iXi 

= (s!%r imod 2k /di*) ° 


(1 <j<k). 
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Finally, compute g\ m (0 < m < 2k — 1) and build the public key e. 


9i m = 


e = 


fsU f (m / a9{,... A}), 
(me {6 i,..-A}), 

(9i,9i°,---,9T k ~\9i°,---,9 b i~ 1 )- 


Step 3. Select the session key s Gr G q and a random number r Gr Z q . Build the 
header H = (H 0 . . . . , H f _i ) by repeating the following procedure for 0 < i < 
t- 1. 


- If Ui n X = 0, set Bi = 0. If Ui n X = Ui , set = 0 or 1. Otherwise 
(Ui OAf/% UiC\X / Ui), set Bi - 1 . Then, compute Hi as follows. 


Hi = (hi,hi, 0 ,...,h it 2k-i), 


hi = 

hi ,j = 


j9l (Bi = 0), 

Us (Bi = 1), 

{ 9i jr (j / «=mod 2k, Bi = 0), 

^ 3 3 (j / «=mod 2k, Bi = 1), 

s 9i ir (j — * m °d 2 k, Bi = 0), 

stfUf (i = i mod 2/c > = !)) 


9a = 


{ 


(j /&{,..., Q k }), 
(j e {6i,...,9k}), 


j v j, lfil~\ 1 ~Vj,kfik 




where g 3 6l , . . . , g 3 ° k are computed from the following system of equations. 

93 fc} = ( 93 z 9s z j 93 * 9 a (1 < h)> 

Observe that if the challenge 4-tuple is a Diffie-Hellman tuple, H is a valid 
input. Otherwise, it is an invalid one in which the k colluders in C are not 
revoked. 

Step 4. Give H, e, (aq, i\, d\), . . . , (x k , i k > dk) to T>^ lst . If T>^' st decides that H is 
a valid input, then output “Diffie-Hellman tuple.” Otherwise output “Random 
tuple.” Since behaves differently for valid inputs and invalid ones, A4 DDH 
can solve the given DDH challenge. 

Since C with X fl C = 0, \C\ = k can be chosen arbitrarily in Step 14.21 it 
holds that T>^ lst => At DDH for any C with X fl C = 0, \C\ = k. This completes 
the proof. □ 

Lemma 2 (Secrecy of a Session Key in an Invalid Input). When given 
an invalid input, the computational complexity for any coalition of k subscribers 
revoked in the invalid input to compute the session key corresponding to the input 
is at least as difficult as DDH in G q . 
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Proof. Let C be a set of k colluders revoked in the invalid input and A4™ mp be 
a p.p.t. algorithm the coalition C uses to compute the session key corresponding 
to the input. Let be a p.p.t. algorithm the coalition C uses to distinguish 

the session key corresponding to the input from a random element in G q . We 
prove that A4( omp => M T>ml for any C with C C X, \C\ = k. 

Since it is clear that 7 Vl^ lst can be constructed by using vVl™ mp as a subrou- 
tine, it holds that A4( nnp => M^ lst for any C with CCA', \C\ = k. Therefore, 
we show that =>• At DDH for any C with CCA, \C\ = k by constructing 

Af DDH using Me as a subroutine. The construction of Af DDH is as follows. 

Algorithm 3 (P.p.t. Algorithm A1 DDH ). 

Input: a challenge 4-tuple, (gi, 92 , 93 , 94 ,)- 
Output: “Diffie-Hellman tuple” or “Random tuple.” 

Step 1. Choose a set of subscribers U (C Z f; \{0}) and split U into i disjoint sub- 
sets Zfo, . . . ,Ui- 1 . Select a set of revoked subscribers X (C U) with a condition 
that there is at most one subset Ui (0 < i < t — 1) s.t. Ui n X / Ui n X / Hi. 
Then, choose a set of k colluders C s.t. CCA. 

Step 2 . Suppose that C = [xi. .... x^}. Construct the personal key ( Xj,ij,dj ) 
given to the subscriber, Xj £ Ui ,. , and the public key e = ( 51 , f/“° , . . . , g" 2k l , 
g\ a ■ ,g\ e ~ x ) by executing the same procedure as in Step 14.21 of Algorithm [H 

Step 3. Select the session key s Gr G q and random numbers r, x, y Gr Z g . Build 
the header H = (Ho , . . . , Hp_ 1 ) by repeating the following procedure to compute 
Hi = (hi, hifi , . . . , hi, 2 k 1 ) for 0 < |< l — 1. 

— If X D lii = 0, then compute H,, as follows. 



— If X r\Ui = Ui, then set B L = 0 or 1 and compute Hi as follows. In each 
time, a random number Zi Gr Z q is selected randomly. 



g r 3 (Bi = 0), 

Si S3 ( B i = !)» 

h(j ( j / «=mod 2k), 

Sf (j=i mod 2k), 


where if there exists a subset U t (0 < t < t — 1) s.t. X n U t / =$ and 
Xr\U t / U t , then 



(Bi = 0), 
(Bi = 1). 
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Otherwise (A tlHi = 0 or A C\Hi = Hi for any i), 



- If X C\Ui / ftand XnHi / Hi, then first, suppose that Ui\X = {m , . . . , u w } 
and choose 2k — w — 1 distinct elements u w +i, ■ ■ ■ , « 2 fc-i Sr Z g \(WU {0}) 
when 2k — w — 1 > 0. Secondly, find Co, . . . , C 2 k-i €r Z f/ s.t. Ysj= p 1 c i u a = 
0 mod q for 1 < a < 2k — 1. Finally, compute H, as follows. 



( j / *=mod 2k), 


S9i (S'lfl's)** (92 alY* (j = i mod 2k). 


In this procedure, is computed as in Step 14.21 of Algorithm [U Observe 
that if the challenge 4-tuple is a Difiie-Hellman tuple, s is the session key corre- 
sponding to H. Otherwise, it is not. 

Step 4. Give s, H, e, (xi, i\, d\), . . . , (xk, ik, dk) to Mc' st . If decides that 

s is the session key corresponding to H. then output “DifRe-Hellman tuple.” 
Otherwise output “Random tuple.” Since M^ st behaves differently for session 
keys and random elements in G q , _A4 DDH can solve the given DDH challenge. 

Since C with C C X, \C\ = k can be chosen arbitrarily in Step 14.21 it holds 
that A4c lst => At DDH for any C with CCA, |C| = k. This completes the proof. 


□ 


Lemma 3 (Indistinguishability of a Suspect). The computational complex- 
ity for any coalition of k subscribers to distinguish (1) an invalid input in which 
a given subscriber other than the k ones is not revoked from (2) an invalid one 
in which the subscriber is revoked is as difficult as DDH in G q . 

Sketch of Proof. Due to space limitation, we describe a sketch of the proof. 
Let C be a set of k colluders. Let Ac' st be a p.p.t. algorithm the coalition C uses 
to distinguish an invalid input in which the given subscriber is not revoked from 
an invalid one in which the subscriber is revoked. Similarly in the proofs of the 
other lemmas, we construct A4 DDH using Ac' st as a subroutine. 

Algorithm 4 (P.p.t. Algorithm M DDH ). 

Input: a challenge 4-tuple, (<7i, 52 , 93 , 94 ) ■ 

Output: “Diffie-Hellman tuple” or “Random tuple.” 

Step 1. Choose a set of subscribers U (C Z g \{0}) and split U into i disjoint 
subsets Uq, . . . ,lii - Select a set of k colluders C and one subscriber u 6r U\C. 
Suppose that u £ H t , Hi fl X = Hi for 0 < % < t — 1, and Hi 0 X = 0 for 
t+l<i<l — 1. There are three possible relations between H t and X: (1) 
H t n A / H t , H t O A / ft both when u (£ X and u £ A, (2) H t 0 A = 0 when 


272 T. Matsushita and H. Imai 


u ^ X, and U t fl X = {u} when u £ X, (3) U t n X = U t \ {«} when u £ X, and 
U t r\X=U t when u£X. 

Step 2. Suppose that C = {x\, . . . ,x k }. Construct the personal key ( Xj,ij,dj ) 
given to the subscriber, Xj £ Uj :i , and the public key e = (gi,gi°, ■ ■ ■ , 5 , “ 2fc_1 , 
gl °, . . . ,Sh* _1 ) by executing the same procedure as in Step 14.21 of Algorithm O 

Step 3. Build the header H in which (1) if the challenge 4-tuple is a Diffie- 
Hellman tuple, the subscriber u is not revoked and (2) otherwise, the subscriber 
u is revoked, in each case. The construction of H is similar to that in Step 14.21 
of Algorithm [3l 

Step 4. Give u, H, e, (x 1 ,ii,d 1 ). . (x k ,i k , d k ) to Ac lst . Since A$ lst behaves dif- 
ferently for invalid inputs in which the subscriber u is not revoked and invalid 
ones in which the subscriber u is revoked, Af DDH can solve the given DDH chal- 
lenge. □ 

From Lemma [lj Lemma |2j and Lemma |3j it follows that the next theorem 
holds. 

Theorem 2 (Black-Box Traceability). In the proposed scheme, from the pi- 
rate decoder constructed by a coalition of at most k traitors, at least one of them 
can be identified with probability 1 — e where e is negligible. 

Proof. Recall that ctrj (0 < ctr, < to) denotes the number of times of observing 
that the pirate decoder decrypts correctly the input in which X = {tti, . . . , Uj}, 
i.e., the subscribers u\ ,Uj are revoked. Define j = 0 if X = 0, i.e., the input 
is valid. It is clear that ctro = to. From Lemma [5J it holds that ctr n = 0 with 
overwhelming probability. From the triangular inequality, it follows that there 
exists an integer j £ {1, . . . , n} s.t. ctrj - 1 — ctrj > m/n. If the subscriber Uj is 
not a traitor, ctrj - 1 — ctrj <C m/n since it follows from Lemma [3] that the pirate 
decoder cannot distinguish an invalid input in which X = {u \ , . . . , Uj- 1 } from an 
invalid one in which X = {iq, . . . , Uj } with non-negligible advantage. Therefore, 
the subscriber Uj is a traitor with overwhelming probability if ctrj - 1 — ctrj is 
the maximum. 

Next, consider the case where the reaction mechanism is activated. From 
Lemma [TJ no such reaction is triggered as long as X fl C = 0 where C denotes a 
set of the colluders. Therefore, if the reaction is triggered in the input in which 
X = {ui, . . . , Uj}, it holds that {;«i , . . . ,Uj}C\C / ft In this case, if the subscriber 
Uj is not a traitor, the pirate decoder must have taken the reaction in the previous 
input in which X = {ui , . . . , ity-i} since it follows from Lemma 0 that the pirate 
decoder cannot distinguish an invalid input in which X = {u\, . . . ,Uj} from an 
invalid one in which X = {ui . . . . , Uj-±} with non-negligible advantage. Hence, 
if the reaction is triggered in the input in which X = {u \, . . . , Uj } , it holds that 
the subscriber Uj is a traitor with overwhelming probability. □ 

Note that our scheme can be easily applied to the case where the pirate 
decoder takes the reaction in a probabilistic way. 
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5 Efficiency 

In Tabled the previous schemes and ours are compared from the viewpoints 
of each subscriber’s storage, the transmission overhead, the number of sets of 
suspects required for tracing, the detection probability, and the computational 
cost for decryption. The scheme of [2] is omitted since its efficiency is almost the 
same as that of [8] in the above criteria. We suppose that the standard ElGamal 
encryption scheme is straightforwardly used in the scheme of [B] . 


Table 2. Efficiency comparison (V, <S, Ti\ sets of possible personal keys, session keys, 
and headers respectively, n: the total number of subscribers, k\ the maximum coalition 
size, c: a constant (0 < c < 1), e: negligible probability) 



Each subscrib- 
er’s storage 

(log |^|/log |<S|) 

Transmission 

overhead 

(log |7f|/ log |<S|) 

# of sets 
of suspects 
for tracing 

Detection 

probabil- 

ity 

# of exp.’s 
for decryp- 
tion 

m 

1 

2fc + 1 

jk 

1 — e 

0(k) 

m 

(1 - c)- 1 

(l-c)-V- c 

n~ c 

Ottl-c)- 1 ) 

0 (c = l/2) 

2 

2^ 

\fn 

W n 

0(1 ) 

Ours 

1 

4 k + n/2k + 2 

n 

1-e 

o(k) 

Ours (ft = y/n/S) 

1 

2^2n + 2 

n 

1-e 

OWn) 


In the scheme of [6], the size of a personal key is determined by a constant 
c (0 < c < 1) selected when initializing the system. In the other schemes, the 
size of a personal key is constant. In the scheme of [8], the efficient transmission 
overhead which is linear only in k is achieved where k is the maximum coalition 
size. However, the scheme of [5] can only support black-box confirmation in which 
only k suspects can be tested in one confirmation. Therefore, the tracer needs 
to execute the confirmation algorithm on all of the possible (£) sets of suspects 
at the worst case, where n is the total number of subscribers. Since the number 
of sets of suspects required for tracing is directly affected to the running time 
of the tracing algorithm, the scheme of [8] is impractical from this viewpoint. 
On the other hand, in the scheme of [B] and ours the number of sets of suspects 
required for tracing is drastically reduced and hence the practical convergence 
time for tracing is achieved. 

In the scheme of [B], the output of the tracing algorithm is the list of suspects 
in which at least one traitor is included with overwhelming probability. If the 
tracer attempts to identify the traitor only from the suspect list, the probability 
that the tracer correctly detect the traitor is n~ c , since the list size is n c . Due 
to its combinatorial construction, there is a trade-off between the transmission 
overhead and the detection probability in the scheme of [B]. The value of c 
which gives the smallest header size and detection probability at the same time is 
c = 1/2 and in this case the header size is O(^fri) and the detection probability is 
1 / yjn. Although the sublinear header size is achieved in the scheme, its detection 
probability becomes smaller as n gets larger. 


274 T. Matsushita and H. Imai 


In our scheme, efficient black-box tracing is achieved without the above list- 
tracing approach, i.e., there is no such trade-off. The header size is linear in k 
and the number of subsets of subscribers. Especially, if we set k m <Jn/ 8, the 
header size is 0(\/n), where we assume that the size of each subset is 2k. The 
tracer can identify at least one traitor with overwhelming probability, regardless 
of n. By applying the key-generation method of [9] to the scheme of [8], our 
scheme enables the tracer to make it impossible for the revoked subscribers to 
compute the session key by substituting a random value for the element used 
only by the subscribers in one of the £ disjoint subsets if all of them in the subset 
are revoked. This helps to remove the restriction of the number of suspects in 
the previous schemes with black-box confirmation and hence efficient black-box 
tracing without sacrificing the detection probability is achieved. On the value of 
m, which is the number of repetition times of the test in the tracing algorithm, 
it is shown in [B] that at least one traitor can be identified with overwhelming 
probability if m = 0(n 2 log 2 n). By using this result, it can be said that the 
running time of the tracing algorithm is 0(n 3 log 2 n). 

The main differences between the scheme of [6] and ours are the detection 
probability and the computational cost for decryption. While in the scheme of [6] 
the detection probability gets smaller as the value of n increases, in our scheme 
it is independent of n and always overwhelming. On the other hand, the scheme 
of [5] is efficient from the viewpoint of the computational cost for decryption. In 
the previous scheme, only a few exponentiations are needed, while the number of 
exponentiations required for decryption is 0(k) in ours. This can be alleviated 
by using a technique of vector-addition chain exponentiation [TTJ p.622]. 


6 Conclusions 

In this paper, we have proposed a sublinear public-key black-box tracing scheme 
against self-defensive pirate decoders. This can be viewed as a solution to the 
open question to build a sublinear traitor tracing scheme that supports efficient 
black-box tracing against self-defensive pirate decoders with negligible probabil- 
ity of error. 
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Abstract. We present a batch version of Schnorr’s identification scheme. 
Our scheme uses higher degree polynomials that enable the execution 
of several Schnorr’s protocol at a cost very close to that of a single 
execution. We present a full proof of security that our scheme is secure 
against impersonation attacks. 

The main application of this result is a very efficient way for a party to 
prove that it holds several secret keys (i.e. identities), where each identity 
is linked to a specific authorization. This approach protects the privacy of 
the prover allowing her to prove only the required set of authorizations 
required to perform a given task, without disclosing whether she is in 
possession of other privileges or not. 

We also show that our scheme is suitable to be implemented on low- 
bandwidth communication devices. We present an implementation of a 
smart card employing recent technology for the use of LEDs (Light Emit- 
ting Diodes) for bidirectional communication. Another contribution of 
our paper is to show that this new technology allows the implementation 
of strong cryptography. 


1 Introduction 

Identification, also known as entity authentication, is a process by which a ver- 
ifier gains assurance that the identity of a prover is as claimed, i.e. there is 
no impersonation |MOV971ISch96| . An identification scheme enables a prover 
holding a secret key to identify itself to a verifier holding the corresponding 
public key. 
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The primary objectives of an identification protocol are completeness - in 
the case of honest parties the prover is successfully able to authenticate itself to 
the verifier, and soundness - a dishonest prover has a negligible probability of 
convincing a verifier. 

There are various grades of dishonesty and corresponding levels of security. 
The goal of the adversary is to impersonate the prover. As per the standard se- 
curity framework |FFS88] , the adversary is allowed various attacks on the honest 
prover, which complete before the impersonation attempt. A typical requirement 
of identification protocols is that they be secure against impersonation under 
passive attack, where the adversarial prover has access to transcripts of prover- 
verifier interactions. A stronger requirement is that protocols be secure against 
active attacks where the adversarial prover can actively play the role of a cheat- 
ing verifier with the prover numerous times before the impersonation attempt. 
Security against impersonation under active attack has been the traditional goal 
of identification schemes. 

However, in recent times interest has been growing in still stronger attacks, 
e.g. concurrent attacks. In these attacks, just like with active attacks the ad- 
versarial prover gets to play the role of cheating verifier prior to impersonation 
with the key distinction that the adversary is allowed to interact with multiple 
honest prover clones concurrently [FFS88| . 

It is very important to keep in mind that, in the real world, identification 
protocols provide assurances only at the instant of time when the protocol is 
successfully completed. It is therefore important to ensure that the identifica- 
tion process is tied to some form of ongoing real-world integrity service. At some 
level all identification schemes are vulnerable to the adversary who cuts in im- 
mediately after the successful identification of the legitimate party. 

Zero-knowledge Protocols. A paradigm introduced in |FFS88] to construct 
identification protocols, is to construct zero-knowledge proofs of knowledge. These 
are protocols which allow a prover to demonstrate knowledge of a secret while 
revealing no information whatsoever other than the one bit of information re- 
garding the possession of the secret |GMR851IFFS88| . 

A protocol is said to be honest-verifier zero-knowledge if it is zero-knowledge 
when interacting with honest verifiers. An honest- verifier zero-knowledge proto- 
col has a weaker security guarantee than a general zero-knowledge protocol since 
it is possible that a dishonest verifier can extract information from the prover in 
the former protocol. 

However, when used as identification schemes, the ultimate measure of the 
worth of a protocol lies in its security against impersonation attempts and a 
protocol that is secure against impersonation against concurrent attacks is con- 
sidered to be ’’secure” even if it is “only” honest- verifier zero- knowledge. This 
happens if one is able to show that whatever information is leaked to the dis- 
honest verifier, it does not help him in any impersonation attack. 

Schnorr in |Sch91] presents such a protocol, based on the hardness of comput- 
ing discrete logarithms. The details are described in the body of the paper, but 
here we just remark that Schnorr’s protocol is an honest-verifier zero-knowledge 
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proof of knowledge of a discrete logarithm. Recently Bellare and Palacio in 
|BPa02] showed that under a slightly stronger assumption on the security of 
discrete logarithms, Schnorr’s protocol is a secure identification scheme against 
concurrent attacks. 

1.1 Authorization 

Authorization is the conveyance to the verifier that the prover, has the sanction 
to gain access to a particular resource set, or belongs to a certain privilege class. 
Authorization may be effected by the proving of one or of multiple identities. 

Consider now the following access control scenario. Users of a given system 
belong to various privilege classes. Access control classes for the data are defined 
using these privileges, i.e. as the users who own a given subset of privileges. For 
example the access control class for a given piece of data D, is defined as the 
users who own privileges Pi, P r 2 -, P 3 ■ 

A way to implement such an access control system is to give each user a certi- 
fied public key. The certificate would indicate the subset of privileges associated 
with this public key. Then in order to gain access, Alice performs an identifica- 
tion protocol based on her public key, and if her privileges are a superset of the 
ones required for the access she is attempting, access is granted. 

There are several drawbacks with this approach. But the main one is a blatant 
violation of Alice’s privacy. Whenever Alice proves her identity she reveals all 
her privileges, when, theoretically, in order to gain access she should have had 
to reveal only a subset of them. 

It is clear that there are situation which warrant a privacy-preserving au- 
thorization mechanism, in which Alice can gain access by proving she owns the 
minimal set of required privileges. 

This can be done by associating a different public key to each privilege. Then 
Alice would prove that she knows the secret keys required for the authorization. 
Using typical proofs of knowledge, like Schnorr’s, to prove knowledge of k keys 
the user has to perform k proofs. Although these proofs can be performed in 
parallel, keeping the round complexity the same, the computational complexity 
goes up by a factor of k. 

Thus an interesting question is if it is possible to perform a proof of knowledge 
of d secrets at the cost of less than d proofs. We answer this question in the 
affirmative (see below). 

Another advantage of associating different keys to different privileges, is that 
the latter can be easily transferred simply by transferring the corresponding 
secret key. 

1.2 Our Contributions 

We present a batch version of Schnorr’s protocol. In our scheme the prover can 
prove knowledge of d secret keys (discrete logarithms), at a cost slightly superior 
to the cost of a single Schnorr’s protocol, thus saving a factor of d in computa- 
tion and bandwidth over the best previously known solutions. We use degree d 
polynomials to represent an ordered list of d identities. We show that the result- 
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ing scheme is not only honest- verifier zero-knowledge, but that it is also a secure 
identification scheme against impersonation under concurrent attacks |BPa02j . 

This immediately yields a very efficient privacy-preserving authorization mech- 
anism along the lines described in the previous section. 

Finally, in order to showcase the efficiency of our proposal we present an 
implementation in a very low-bandwidth environment. We use recently proposed 
technology to use Light Emitting Diodes (LEDs) as bi-directional communication 
devices. We believe that another interesting contribution of our paper is to show 
that this new technology is robust enough to implement strong cryptographic 
solutions. 

1.3 Related Work 

Besides the works cited above |GMR85HFFS88IISch91] . another widely used 
protocol for identification is the one proposed by Guillou and Quisquateur in 
|GQu88| . This scheme is more efficient than Schnorr’s and very suitable to low- 
power computation devices. When proving multiple identities simultaneously, 
our batch technique makes the advantage of using GQ over Schnorr’s disappear 
very quickly. Indeed only for very small values of d (the number of identities 
being proven), d parallel executions of GQ beat our batch Schnorr protocol in 
efficiencj0- It would be interesting to devise a batch version of the Guillou- 
Quisquateur protocol, but we were not able to do so. 

In any case, when comparing our scheme with running d Guillou-Quisquateur 
schemes, one should remember that the GQ scheme is based on a different as- 
sumption (RSA inversion) than the Schnorr’s protocol. 

Our new identification scheme is related to the concept of batch verifica- 
tion of signatures |BGR98| . As far as we know there has not been any work on 
batch verification for identification protocols. A straightforward application of 
the techniques in |BGR.98| to our problem would yield a much less efficient pro- 
tocol. Moreover, the mathematical techniques we use are fundamentally different 
than the ones in |BGR98j . 

Recently the area of privacy-preserving protocol has received a lot of atten- 
tion. We refer the reader especially to the works by Camenisch and Lysyanskaya 
|CL011IGL02] . where the concept of group signature is used to show how a user 
can prove membership in a certain privilege class, without revealing her true 
identity. These solutions offer a very strong privacy guarantee, as a user can 
safely prove his privileges to various verifiers, who would not be able to link 
her various transactions. On the other hand our solution does not protect the 


1 Jumping ahead, assume we perform Schnorr’s scheme, with parameters p, q such 
that |p| = 1024 and \q\ = 160. Then one execution of the protocol costs about 
240 multiplications for the prover (i.e. one exponentiation modp. with a 160-bit 
exponent). On the other hand, if we perform the GQ scheme over a 1024-bit RSA 
modulus, using a small public exponent (like 3), and security parameter 80, then the 
prover’s cost is about 80 multiplications. Thus GQ is approximately 3 times as fast 
as Schnorr’s. Which means that for d > 3, i.e. when proving more than 3 identities 
simultaneously, our batch Schnorr protocol becomes more attractive than GQ. 
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identity of the user, but simply allows her to prove the minimal set of privileges 
required for a given transaction. But if verifiers collude they can link the user’s 
transactions and reconstruct the set of privileges she holds. For example if Alice 
proves to Bob that she belongs to privilege class PI, and to Charles that she 
belongs to the P2 class, it is possible for Bob and Charles together to understand 
that Alice holds both PI and P2 privileges. On the other hand our solution is 
much simpler and more efficient that solutions based on group signatures, thus 
it could be preferable in a scenario in which collusion is not really a problem. 
Moreover some of our batching techniques can be used to speed-up solutions 
based on group signatures (since there, the proof of possession of several keys is 
a subprotocol). 


2 Preliminaries 

In this section we recall the basic definition of proof of knowledge, the compu- 
tational assumptions that we are going to need, and Schnorr’s protocol. In the 
following the acronym PPT stands for “probabilistic polynomial-time”. 

2.1 Proofs of Knowledge 

Polynomial Time Relationships. Let 1Z be a polynomial time computable 
relationship, i.e. a language of pairs (y, w) such that it can be decided in polyno- 
mial time in \y\ if (y,w) € 1Z or not. With C-jz we denote the language induced 
by 1Z i.e. C n = {y : 3w : ( y,w ) € 1Z}. 

More formally an ensemble of polynomial time relationships VT1Z consists of 
a collection of families VT1Z = U n VTTZ n where each VT 1Z n is a family of poly- 
nomial time relationships lZ n . To an ensemble VTTZ we associate a randomized 
instance generator algorithm IG that on input l n outputs the description of a 
relationship 1Z n . In the following we will drop the suffix n when obvious from 
the context. 

Example: The instance generator algorithm on input 1” outputs an n-bit prime 
q, a poly(n)- prime p, such that q\p — 1 and an element g of order q in Z*. 
The corresponding relationship is that of pairs (y,w) C Z* x Z q such that 
y = g w mod p. 

Proofs of Knowledge. In a proof of knowledge for a relationship 1Z, two 
parties, Prover P and Verifier V, interact on a common input y. The Prover also 
holds a secret input w, such that (y, w) e 7 Z. The goal of the protocol is to 
convince V that P indeed knows such w. Ideally this proof should not reveal any 
information about w to the verifier, i.e. be zero-knowledge. 

The protocol should thus satisfy certain constraints. In particular it must 
be complete: if P knows w then V should accept. It should be sound: for any 
(possibly dishonest) prover who does not know w, the verifier should almost 
always reject. Finally it should be zero-knowledge: no (poly-time) verifier (no 
matter what possibly dishonest strategy she follows during the proof) can learn 
any information about w. 
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A formal definition of proofs of knowledge can be found in |BGo93] (improving 
on the original definition in |FFS88] b Informally, the concept of “knowing” w is 
formalized by showing that w can be computed in polynomial-time if we have 
black-box access to P. This is done by constructing a witness extractor which 
runs in probabilistic polynomial time, and computes w with a probability related 
to the probability that the Prover makes the Verifier accept. 

The concept of zero-knowledge is formalized via the existence of a probabilis- 
tic polynomial time simulator S that on input y and interacting with a possibly 
cheating Verifier outputs transcripts with the same probability distribution as 
the real prover (who knows w). 

A formal definition follows. With [P(y, w), V(y)] we denote the output of the 
protocol, i.e. 1 iff V accepts. With 7rp(n) we denote the probability that a prover 
P makes the verifier accept, i.e. 

n P (n) = Prob[K n «- IG(1") ; [P(y, •), V(y)] = 1] 
where the statement y can be chosen by P. 

Definition 1. We say that (P,V) is a proof of knowledge for a relationship 
(VT1Z, IG) if the following properties are satisfied: 

Completeness. For all ( y , w ) e lZ n (for all lZ n ) we have that [P(y, w), V(y)]=l. 

Witness Extraction. There exist a probabilistic polynomial time knowledge 
extractor KE, a function n : {0, 1}* — ► [0, 1] and a negligible function e, such 
that for all PPT P\ ifnp>(n) > k(h) then KE, given rewind access to P', com- 
putes w such that ( y,w ) e TZ n with probability at least 7rp >(n) — n(ri) — e(n). 

Zero-Knowledge. For every PPT Verifier V' there exist a probabilistic poly- 
nomial time simulator SIMy', such that for all (y, w) e lZ n the two random 
variables 

View[P (y,w),V'(y)] 

View[SIM V'(y),v'(y)] 

are indistinguishable. 

The function n is called the knowledge error and measures the probability, 
inherent to the protocol, that a cheating prover can convince the verifier without 
knowing w. What we require is that if a prover convinces the verifier with a prob- 
ability higher than k, then we can extract the witness with a success probability 
related to the difference. 

2.2 Identification Schemes 

In an identification scheme a prover P and a verifier V interact on input a public 
key (generated together with its matching secret key by a key generation algo- 
rithm KG). The prover holds the matching secret key, and his goal is to convince 
the Verifier of this fact, and thus of his identity. 
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An impersonation attack is when an adversary A tries to convince the verifier 
that he is the honest prover. This kind of attack is called a passive attack, if the 
adversary attempts impersonation only after having witnessed several correct 
executions of the identification protocol between the prover and honest verifiers. 
We said that an attack, is active, if the adversary before trying to impersonate 
the prover has engaged with him in the identification protocol, playing the role 
of a (possibly dishonest) verifier. 

Finally, and this is the notion we consider in this paper, we say that an 
active impersonation attack is a concurrent attack if the interactions between the 
adversary and the honest prover before the impersonation attack, can be carried 
out in a concurrent fashion (i.e. with an arbitrary scheduling of messages). 

So we can consider the following game. A pair of keys sk,pk is chosen according 
to the distribution induced by KG on input 1" the security parameter. The prover 
is given sk and pk is made public. Then the adversary A engages as a verifier in 
several concurrent executions of the identification protocol with the prover. He 
then finally runs one execution of the protocol, as the prover, with an honest 
verifier. We denote with advert) the probability that A makes the verifier accept 
at the end of this game. 

Definition 2. We say that an identification protocol is secure against concur- 
rent impersonation attack if ads/^fn) is negligible in n. 

2.3 Discrete Logarithm Assumptions 

Since its introduction in the seminal paper by Diffie and Heilman |DH78| , the dis- 
crete logarithm assumption has been widely used to construct cryptographic algo- 
rithms. Here we are going to use a well established variant of the assumption that 
considers the hardness of computing discrete logs in subgroups of prime order. 

Consider the example we described above. On input a security parameter 
1 ", we generate an n-bit prime q, a poly(n)-prime p, such that q\p — 1 and an 
element g of order q in Z* (the multiplicative group of integers modp) . In the 
group generated by g we can consider the exponentiation function that maps 
w e Z q to y = g w mod p. The discrete log assumption says that if we choose w 
at random then it is infeasible to compute w, when given only y. 

Assumption 1. We assume that computing discrete logarithm is hard, i.e. for 
every PPT Turing Machine I (for inverter) the following probability 

advx(n) = Prob[T(p, q,g,y = g w mod p) = w] 

is negligible in n. The probability is taken over the internal coin tosses of I, the 
random choices of q as n-bit prime, p as a poly(n)-bit prime such that q\p — 1. 
w Gr Z q , while g is an arbitrary element of order q in Z*. 

In the following we are going to use a stronger variant of the discrete log as- 
sumption, introduced in |BNPSfllllBPa02] . In this variant once we have selected 
p, q at random and chose g, we give the inverter 1 access to two oracles. The 
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challenge oracle Ch, when invoked outputs a random element in the group gener- 
ated by g. The discrete log oracle DL when queried on a value y e (g) will output 
w such that y = g w mod p. The goal of I is to invert all the values issued to him 
by the challenge oracle (and I must invoke Ch at least once), but is restricted 
to invoke DL a number of times, which is strictly smaller than the number of 
times he invoked Ch. We denote with adv^ h,DL (n) the probability (taken over the 
choices of p, q and the internal coin tosses of 1 and Ch) that 1 succeeds in this 
game. 

Assumption 2. We assume that the problem of one more inversion of discrete 
logarithms is hard, i.e. we assume that advj h,DL (n) is negligible in n. 

Note that when the number of queries to Ch is equal to 1, this assumption 
is equivalent to Assumption [T] Though Assumption [5] is new, it looks reason- 
able and has the advantage enunciated in |BPa02] of reducing the security of 
our identification scheme to the hardness of a well-specified number theoretic 
problem. 

2.4 Schnorr’s Identification Scheme 

Let p and q be two primes such that q\p—l and |g| = n. Let g /= 1 be an element 
of order q in Z*. Let G q be the subgroup generated by g. The integers p, q, g are 
known and can be common to a group of users. 

An identity consists of a private/public key pair. The private key w is a 
random non-negative integer less than q. The public key is computed as y = 
g~ w mod p. 

The protocol is described in Figured] 

It is well known that Schnorr is an honest- verifier zero-knowledge proof of 
knowledge of w, the discrete logarithm of y. The reader is referred to |Sch91| for 
details. The protocol is only honest-verifier ZK, because if a dishonest verifier 
chooses the challenge e in a non-random way (particularly dependent on the first 
message x ) we are not able to simulate the interactior0. 

However in |BPa02] it is shown that the Schnorr scheme is secure against 
impersonation, under concurrent attacks, under the assumption that discrete 
logarithm is secure under one more inversion in the underlying group. 

3 The New Identification Scheme 

In this section we present our generalization of Schnorr’s scheme to the case in 
which the prover wants to prove multiple identities. 

A naive generalization of Schnorr’s scheme would be to do the simultaneous 
authentication of d identities by composing d rounds in parallel. In other words 


2 Note that it is also necessary to check that y is in the proper group, by checking that 
y q = 1 mod p, see |Bur90l . This can be added as a verification step, or the verifier 
can trust the certification authority that certified y to have performed the test. A 
similar requirement holds for our protocol. 
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Schnorr 

Common Input: p,q,g,y. A security parameter t. 

Secret Input for the Prover: u)E 2, such that y = g~ w mod p. 

1. Commitment by Prover. Prover picks r €r Z q and sends x = g r mod p to 
the Verifier. 

Prover x ~ 3 Verifier 

2. Challenge from Verifier. Verifier picks a number e €r [1. .2*] and sends it 
to the Prover. 

Prover £ Verifier 

3. Response from Prover. Prover computes s = r + w ■ e mod g and sends it 
to the Verifier. 

Provef^V s = r + w ■ e ^ Verifier 

The Verifier checks that x = g s -y e mod p and accepts if and only if equality 


Fig. 1. Schnorr’s protocol 


the prover would send over d commitments and the verifier would reply with d 
challenges - one per identity. Note that this scheme has a communication and 
computation cost that is d times the cost of Schnorr’s original scheme. A possible 
improvement would be to use the same challenge for all rounds, and apply batch 
verification techniques (such as the ones in |BGR98j ) to the last verification step. 
Even with these improvements, the communication and computation cost of the 
whole scheme would still be higher by a factor of d (the prover would still have 
to send and compute d commitments). 

We propose a more efficient scheme where the prover sends one commitment 
and the verifier sends one challenge across all identities. The prover’s response 
is generalized from a degree one polynomial to a degree d polynomial formed 
from the d secret keys. We are able to show that the resulting scheme is sound 
and further that it is secure against impersonation under concurrent attacks 
by extending the corresponding arguments in (Sch91j and |BPa02] respectively. 
We present two theorems that demonstrate that the new scheme is an honest- 
verifier zero knowledge proof of knowledge and also a secure identification against 
impersonation under concurrent attacks. 

The parameters are very similar to Schnorr. Let p and q be two primes such 
that q\p — 1. Let g /= 1 be an element of ordeir/ in Z*. The integers p,q,g are 
public, and can be common to a group of users. 
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We have d identities, each consisting of a private/public key pair indexed by 

i. The private keys w t axe non-negative integers less than q, chosen uniformly at 
random. The public keys are computed as yi = g~ Wi mod p. 

The Prover initiates the protocol by sending over the list of public keys 
for which it claims to possess the corresponding private keys W{. The protocol is 
described in Figure |2] 


Batch-Schnorr 

Common Input: p,q,g,yi, ■ ■ ■ ,yd- A security parameter t. 

Secret Input for the Prover: Wi € Z q such that yi = g~ Wi mod p. 

1. Commitment by Prover. Prover picks r €r Z q and sends x = g r mod p to 
the Verifier. 

Prover x = 9 Verifier 

2. Challenge from Verifier. Verifier picks a number e Gr [1..2^ t+logd ^] and 
sends it to the Prover. 

Prover „ __ - - , Verifier 

3. Response from Prover. Prover computes s = r + SiWi • e* mod q and sends 
it to the Verifier. 

I hovef s = r + £i w i ' e ^ Bfirifier 

The Verifier checks that x = g v • Idiyf mod p, and accepts if and only if 
equality holds. 

Fig. 2. Batch version of Schnorr’s protocol 


Theorem 1. Batch-Schnorr is an honest-verifier zero-knowledge proof of knowl- 
edge for d discrete logarithms. 

The complete proof is provided in |CLSY| , 

Notice that the protocol is not zero-knowledge in the general case since a 
dishonest verifier could choose a challenge that is dependent on the commitment 
making it difficult to generate transcripts with the same distribution, without 
knowing the secret keys. Informally, however the reason no information is re- 
vealed is that the numbers x and y, the commitment and the response, are 
essentially random. This is the intuition behind the proof of security as an iden- 
tification scheme. 

The following theorem (Theorem^ shows that Batch-Schnorr is an identifi- 
cation scheme secure against impersonation under concurrent attacks. As men- 
tioned before, this is our ultimate end goal. We extend the proof in |BPafl2| 
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(which shows the security of Schnorr’s scheme under this kind of attack) to our 
scheme. We remind the readers that in a concurrent attack the adversarial prover 
is allowed to play the role of the cheating verifier and interact concurrently with 
multiple honest prover clones prior to the impersonation attempt. Similar to 
|BPa02] our proof is based on the assumption that discrete exponentiation is 
secure under d more inversions in the underlying group (Assumption [2j| . 

Let A denote the adversary that first takes on the role of fraudulent verifier 
and interacts concurrently with several honest prover clones before subsequently 
taking on the role of fraudulent prover. Let adv^(fc) denote the probability that 
A is successful at impersonation. 

Theorem 2. If A succeeds in an impersonation attack on Batch-Schnorr with 
probability adv^fc) then there exists an inverter I such that for every k 

adv^(fc) < 2-Mad4 h ’ DL (fc)) 1 /( d + 1 ). 

Proof. We show how to construct an inverter 1 that interacts with A the imper- 
sonation adversary. Via this interaction X will compute the discrete logarithm 
of all the n points it gets from the challenge oracle, by querying the discrete log 
oracle, at most n — d times. 

First the inverter 1 queries Ch, the challenge oracle, d times and obtains d 
random group elements j/j = g~ Wi . It then runs A in cheating verifier mode 
using the yfs as the public key. For the j th clone prover the commitment x 3 is 
obtained by querying the challenge oracle Ch. The third round response s 3 to 
challenge e 3 is computed by querying the discrete log oracle DL on the value 
XjII^ =1 y k 3 . Notice that this is a perfect simulation of a real concurrent attack. 
With n we denote the total number of queries to the challenge oracle. Notice 
that X queried the discrete log oracle only n — d times. 

Now X runs A in cheating prover mode d + 1 times, rewinding it each time 
to the beginning (of the phase in which A acts as a prover). This in particular 
means that the commitment issued by A stays the same, since its internal state 
is the same. If any two challenges are the same then the inverter X fails. 

Let x = g r be the commitment and let .s, be the response corresponding 
to the distinct challenges ej. If the cheating prover A fails even once then the 
inverter X fails. If the cheating prover A succeeds each of the d + 1 times, then 
the inverter X has d + 1 equations of the form s, = r + UjWj ■ e]. with d + 1 
unknowns, r and the d secret keys w 3 . By inverting the Van der Monde matrix 
formed from these equations, they can be solved to obtain the Wj' s. These are 
the answers to the first d queries X made to Ch. 

Recall that X must answer all the challenges he received from Ch. But the 
answer to each query x 3 can be easily computed as s 3 — SkWk • £j- 

Thus with n — d queries, X succeeds in inverting all the n points asked to the 
challenge oracle. The probability of success is the probability that A succeeds 
d + 1 times. We will now estimate this probability. We first prove an auxiliary 
result that is a generalization of an equivalent result in [BPa02| . 
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Lemma 1 (Generalized Reset Lemma). Consider any prover (potentially 
cheating). Let A and B be random variables over the space of the random coins, 
RP, of the prover. Let A denote the probability, taken over e, that the verifier 
accepts. Let B denote the probability, taken over e’s, that when the verifier is 
reset and run d+1 times, a different e is generated each time and the verifier 
accepts each time. Let acc = E(A) and res = E(B). Then acc < 2 ~ t +res 1 ^ d+1 \ 

Proof. Let 1/c = 2 t+log d be the size of the challenge set i.e. ffe. It is easy to see 
that B > A(A — c) (A — 2c) .. .(A — dc). This implies that B > (A — dc)( d+1 ) 
which yields that E(A) < dc+ E(By/( d+1 ) or E(A) < 2~* + E(B) l / d+l . 

Now observe that adv^(fc) = E(acc), where the expectation is taken over 
the choice of y* and the knowledge gained as the cheating verifier. Similarly 
adv^ h ’ DL (fc) = E(res). Applying the reset lemma we see that 

adv A {k) = E(acc) < E( 2~* + ( res ) 1 /( d + 1 )) = 2~ f + E((re S y^ d+1) ) 
then by applying Jensen’s inequality 

adv A (k) < 2 “* + (E(res)) 1 ^ d+1) m 2~ l + (adv^’ 01 ) 1 ^^ 

This completes the proof of Theorem [5] 

The following corollary is a straightforward consequence of Theorem [2] 

Corollary 1. Under Assumption [H and if t = cj(log k), then Batch-Schnorr is 
a secure identification scheme against i mpersonation under concurrent attack. 

Note that the assumption that t is super-logarithmic in k is necessary, oth- 
erwise the scheme can be broken by guessing the verifier’s challenge. 

3.1 Efficiency Analysis 

For a list of d identities Batch-Schnorr uses only 0(logd ) more bits of communi- 
cation than Schnorr’s scheme for a single identity (assuming the same security 
level). 

In terms of computation Batch-Schnorr requires 2d extra modular multiplica- 
tions for the prover. The verifier has to perform d+1 modular exponentiations, 
while in Schnorr’s scheme it has to perform 2. 

Notice that this is much faster than the known way of proving d identities 
simultaneously, which consists of d copies of Schnorr’s protocol (in the particular 
the verifier would have to perform 2d exponentiations instead of d+1). 

3.2 Authorization Using Multiple Identities 

As we discussed in the Introduction, our identification scheme is suitable to 
implement Authorization using multiple identities without incurring a huge ef- 
ficiency cost. 

When a user joins a particular privilege class he is given a new public key, its 
matching secret key and a certificate that associates the key to that particular 
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privilege class. Another possibility would be to have a unique key for each class, 
but that would make revocation very difficult to handle, as revoking one user in 
the class (say because her key was compromised or because she does not belong 
to the class anymore), would involve replacing the key of all users in the class. 

When a user needs to access certain data or services he uses our identification 
protocol to prove possession of the minimal set of privileges required for that 
access to take place. 

Another advantage of our approach is that it is easy to transfer privileges 
among parties. A motivating scenario for our application is having a smart card 
be able to talk to another smart card and transfer a subset of privileges to it 
(equivalent to a high ranking employee in a corporation enabling selective access 
to a lower ranked employee). In our scheme using multiple identities it is a simple 
matter to transfer the private keys corresponding to the selected list of privileges. 

4 Implementation 

In order to test the efficiency of our scheme we have performed an implementa- 
tion of our scheme. To carry out the implementation we used a recently proposed 
technology based on Light Emitting Diodes. We believe that another contribu- 
tion of our paper is to show that this new technology allows the implementation 
of strong cryptography. 

Light Emitting Diodes, or LEDs, are one of the most ubiquitous interface 
components. Their diverse applications include numeric displays, flashlights, ve- 
hicle brake lights (and possibly even headlights [Hel03| h traffic signals and the 
omni-present power-on indicator. LEDs are so commonly used as light emitters 
that people often forget that they are fundamentally photodiodes and hence light 
detectors. Although LEDs are not optimized for light detection they are very 
effective at it. The interchangeability between solid-state light emission and de- 
tection was widely publicized in the 1970s by Forrest W. Mims |Mim861lMim93] , 
but has since largely been forgotten. 

Recently, a novel microprocessor interface circuit was invented which can 
alternately emit and detect light using an LED [DYL02] . In addition to the 
LED and two digital I/O pins of the microprocessor, the circuit requires only a 
single current limiting resistor. When forward-biased the LED emits light and 
when back-biased it detects/measures the ambient light. The implications of 
LED-based data communication are significant, since it is essentially a software 
interface technique that uses existing hardware with minimal modification. ’’Ev- 
ery LED connected to a microprocessor can be thought of as a generic two-way 
data port” |DYL02] . One can conceive of numerous applications e.g. using the 
power light on consumer appliances as a maintenance port for reading service 
information and uploading new firmware, or capturing a car stereo’s fault log 
through the front panel display. 

We show how to build smartcards that communicate via LEDs and implement 
our Batch-Schnorr protocol. 
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4.1 Hardware 

Batch-Schnorr was implemented using the Microchip PIC16LF628 microcon- 
troller. The hardware was composed of a small printed circuit board 2cm by 
4cm, a single push-button switch, an LED, a 3-volt lithium coin-cell battery, a 
capacitor and two resistors. The PIC uses 8-bit instruction words and runs at 5 
MIPS (million instructions per second). It has 16KB of write-able storage. The 
prototypes were also equipped with an in-circuit programming connector, which 
allowed us to download code into the microcontroller. We also devised a small 
adapter board to convert this connector to Microchip’s standard RJ-11 in-circuit 
debugging module. A mass produced version should cost less than a dollar more 
than a similar LED keychain flashlight. The range of communication is a few 
centimeters at best and the data rate is 250 bits/second in each direction. We 
implemented Batch-Schnorr representing the prover in its full functionality. The 
verifier was implemented as a LED directly controlled by a PC. 

See Appendix B for a picture of our implementation. 

4.2 Security 

We chose a security parameter setting of t = 95. This is generally considered 
adequate security (see |Sch96j ) for most practical purposes. We used d = 32. 
This made f + logd = 100. This forced the prime q to be 200 bits long because of 
the existence of the 0(q 1 / 2 ) baby-step-giant-step algorithm for finding discrete 
logs (see |Sch91] h In conjunction with the existence of the general number field 
sieve (see |LQd91| 'l this, in turn, forced the prime p to be about 1500 bits long. 

4.3 Prover 

The bulk of the implementation effort lay in the code for the prover. An impor- 
tant aspect of our implementation of Batch-Schnorr was that storage was at a 
premium. This is common with most smart cards where the storage is needed 
both for code as well as data. 

The main operation performed by the prover is modular multiplication. We 
initially attempted an implementation of the Fast Fourier Transform (see |Str88| j 
of Cooley and Tukey, which takes 0{n log n) bit operations. However it turned 
out that our practical implementations of this scheme had high code complexity, 
even though it is more efficient asymptotically. 

Hence, we adopted a scheme that utilizes a pre-computed table to substan- 
tially save on both code complexity as well as computation time. For each of 
the private keys we stored a pre-computed table of the residues modulo q of the 
product of the private key with the powers of 2 up to 2 1+log9 . Then to multiply 
the private key with any given number we added the residues corresponding to 
the powers of 2 present in the binary representation of that number. The residue 
modulo q of 2 1+log9 enabled us to reduce the overflow when doing addition, so 
that we always had a number with log q bits. Upon receiving the challenge e we 
first computed a similar table consisting of the residues modulo q of the product 
of e with the powers of 2 up to 2 1+log9 . We then used this table to compute 
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the powers of e, and then used the pre-computed tables of the secret keys to 
compute y = r + Sisi ■ e' mod q. This enhancement enabled the implementation 
to run in less than 2 seconds for our choice of the security parameters. 

5 Conclusion and Extensions 

We have presented a batch version of Schnorr’s protocol. In our scheme a prover 
can prove knowledge of d, keys at essentially the same cost as proving knowledge 
of a single key. We believe this protocol can find several applications in the 
cryptography literature. 

We discussed the application of privacy-preserving authorization mechanisms. 
Also we presented an implementation of our protocol employing a new technol- 
ogy to use Light Emitting Diodes as two-way communication devices. We believe 
this to be another interesting contribution of our paper. 

In terms of future research, it would be interesting to devise a batch version 
of the Guillou-Quisquateur identification protocol. 
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Abstract. Secret handshakes were recently introduced |BDS + 03] to al- 
low members of the same group to authenticate each other secretly , in the 
sense that someone who is not a group member cannot tell, by engaging 
some party in the handshake protocol, whether that party is a member 
of this group. On the other hand, any two parties who are members of 
the same group will recognize each other as members. Thus, a secret 
handshake protocol can be used in any scenario where group members 
need to identify each other without revealing their group affiliations to 
outsiders. 

The work of |BDS+03] constructed secret handshakes secure under 
the Bilinear Diffie- Heilman (BDH) assumption in the Random Oracle 
Model (ROM). We show how to build secret handshake protocols se- 
cure under a more standard cryptographic assumption of Computational 
Diffie Heilman (CDH), using a novel tool of CA-oblivious public key en- 
cryption, which is an encryption scheme s.t. neither the public key nor 
the ciphertext reveal any information about the Certification Authority 
(CA) which certified the public key. We construct such CA-oblivious en- 
cryption, and hence a handshake scheme, based on C DH (in RO M). The 
new scheme takes 3 communication rounds like the |BDS + 03] scheme, 
but it is about twice cheaper computationally. 

Keywords: authentication, privacy, anonymity, encryption. 

1 Introduction 

A secret handshake scheme, introduced by Balfanz et al. [BDS+03] . allows two 
members of the same group to identify each other secretly, in the sense that 
each party reveals his/her affiliation to the other only if the other party is also 
a group member. For example, a CIA agent Alice might want to authenticate 
herself to Bob, but only if Bob is also a CIA agent. Moreover, if Bob is not a 
CIA agent, the protocol should not help Bob in determining whether Alice is a 
CIA agent or not. This secrecy property can be extended to ensure that group 
members’ affiliations are revealed only to members who hold specific roles in the 
group. For example, Alice might want to authenticate herself as a CIA agent 
with security level one if and only if Bob is a CIA agent with security clearance 
two, and vice versa. 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
© Springer- Verlag Berlin Heidelberg 2004 
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In other words, if A is a member of group G a with role r a and B is a membe r 
of G{, with role r*,, a secret handshake scheme guarantees the following [BDS+03] : 

— A and B authenticate each other if and only if G a = G/,Q 

— If G a Gb then both parties learn only the sole fact that G a ± Gb- 

— A can choose not to reveal anything about herself unless B is a member with 
particular role rb (and vice versa) o 

— An eavesdropper or a man in the middle learn nothing from the protocol. 


As observed in [BDS + 03] , secret handshakes seem to require new crypto- 
graphic protocols since they can not be easily obtained from existing tools in 
the “cryptographic toolbox”. For example, group signatures |CVH911lAC.TT00| 
might appear to be an attractive building block for secret handshakes. However, 
they offer anonymity and unlinkability of group members’ signatures, not secrecy 
of membership itself. In the interactive variant of group signatures, called iden- 
tity escrow |KP98j . one party can prove to another its membership in a group 
in an anonymous fashion. However, what turns out to be quite difficult is the 
seemingly simple issue of two parties proving group membership to each other 
simultaneously, in such a way that one party never reveals its group membership 
to another unless the former is also a member of the same group. 


Secret Handshake Scheme as a “CA-oblivious PKI”. To be usable in practice, a 
secret handshake scheme must provide efficient revocation of any group member 
by the Group Authority (GA) which administers the group. To support this 
functionality we will consider secret handshake schemes which, like the scheme 
of fBDS+031 . are similar to PKI’s (Public Key Infrastructures), where the role 
of a group authority corresponds to that of a Certification Authority (CA) in a 
PKI. Namely, to become a member of a group a party needs the GA to issue a 
certificate on an ID bitstring which the CA agrees to assign to this party. The 
certificate must include a CA-specific trapdoor which corresponds to this ID0 To 
revoke some party, the CA puts that party’s ID on a revocation list. To perform 
a handshake, two parties first exchange their ID’s, and then proceed only if the 
ID of the other party is not on the revocation list of their CA. Since the secret 
handshake protocol must hide one’s group affiliation from outsiders, the ID’s 
will be random strings picked from the same domain by all the CA’so 


1 However, as noted by |BDS+03| . a handshake protocol cannot be fair in the sense 
that if G a = Gb then one party is going to learn about it first and could abort the 
protocol and thus withhold their group affiliation from the counterparty. 

2 To simplify the presentation, we will ignore roles for most of the paper. However, as 
we show in appendix lA.il they can be added easily. 

3 For example, in an identity based encryption scheme, the trapdoor is a secret key 
corresponding to the public key which can be recovered from ID and the public 
parameters associated with the CA. In a standard PKI system, this correspondence 
has an added level of indirection: The trapdoor t is a secret key corresponding to 
the public key PK which is in turn bound to the ID string by a signature of CA on 
the ( ID\PK ) pair. 

4 To make protocol runs executed by the same party unlinkable, |BDS + 03] propose 
that a single user gets multiple (ID, certificate) pairs, each to be used only once. 
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In this setting, constructing a secret handshake scheme amounts to solving 
the following protocol problem: For a given CA, Alice wants to prove to Bob 
that she possesses a trapdoor t A issued by this CA on her ID A , but only if Bob 
possesses a trapdoor t B issued by the same CA on his ID B (and vice versa). 
Moreover, the protocol must be “CA-oblivious” in the sense that if a cheating 
Bob is not in the group administered by a given CA, and hence does not hold 
a CA-specific trapdoor t B associated with ID B , then his interaction with Alice 
must not help him in guessing if Alice belongs to this group or not. (And vice 
versa for an honest Bob and a cheating Alice.) While this protocol problem 
can be solved in principle with general 2-party secure computation techniques, 
the issue remains whether it can be solved with a practical protocol, at a cost 
comparable to standard authentication protocols. 

Existing S olutions Based on Bilinear Maps. The secret handshake protocol of 
|BDS + 03] is based on bilinear maps, which can be constructed using Weil pair- 
ings on elliptic curves |Jou021|Gag02| . The protocol of |BDS + 03| builds on the 
non-interactive key-agreement scheme of |SOKOO] , and works as follows. As in the 
identity based encryption scheme of [BFOlj , A and B can compute each other’s 
public keys from each other’s ID’s and from the public parameters associated 
with the CA. If Alice is a group member, she can use her trapdoor t A corre- 
sponding to PK a to non-interactively compute a session key from ( t A ,PK B ). 
Similarly, if Bob is a group member he can compute the same session key from 
( t B ,PK A ). The two parties can then verify if they computed the same key via 
a standard MAC-based challenge-response protocol. Under the Bilinear Diffie- 
Hellman (BDH) assumption, it is easy to show (in the Random Oracle Model) 
that an attacker who does not hold the correct trapdoor cannot compute the 
session key. Moreover, the MAC-based challenge response confirmation proto- 
col has the needed property that without the knowledge of the key, one learns 
nothing from the counterparty’s responses. 

Thus, the “CA-obliviousness” property of the protocol of [BDS + 03] follows 
from two properties of cryptosystems built on bilinear maps: (1) that the re- 
ceiver’s public key can be recovered by the sender from the receiver’s ID, and 
thus the receiver does not need to send any information revealing his CA af- 
filiation to the sender, and (2) knowing their public keys, the two parties can 
establish a session key non-interactively, and thus they again do not reveal any 
CA-specific information. Given that the first property relies on identity based 
encryption, and that the only practical IBE known so far is based on bilinear 
maps |BF01j . it seems that BDH is indeed needed for secret handshakes. 

Our Contributions. In this paper we show that efficient secret handshake (SH) 
schemes can be built using weaker and more standard assumption than the 
BDH, namely the Computational Diffie Heilman (CDH) assumptions. However, 
our security arguments, just like those for the BDH-based scheme of [BDS + 03] 
remain in the so-called Random Oracle Model (ROM). Moreover, th e proposed 
scheme is computationally at least twice cheaper than the scheme of [BDS + fl3] . 
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We show this in several steps: First, we generalize the IBE-based secret hand- 
shake solution sketched above by showing that an efficient four-rounds secret 
handshake protocol can be built using any PKI-enabled encryption with the ad- 
ditional property of CA-obliviousness. We define the notion of (chosen -plaintext 
secure) PKI-enabled encryption, which generalizes both the Identity Based En- 
cryption schemes, and the standard encryption schemes used in the context of 
a PKI system like X.509. We define the CA-obliviousness property for this no- 
tion of PKI-enabled encryption, which requires that both the public-key-related 
information which the receiver provides to the sender, and the ciphertext sent 
from the sender to the receiver, do not reveal which CA issued the receiver’s 
certificate. We then show that every CA-oblivious PKI-enabled encryption leads 
to a four-round secret handshake protocol whose cost is one decryption and 
one encryption for each party. We also show an alternative construction, which 
creates a three-round secret handshake protocol using any CA-oblivious PKI- 
enabled encryption equipped with the so-called zero-knowledge “signature of 
knowledge” [CS97| of the private decryption key. 

Next, we combine ElGamal encryption and Schnorr signatures to construct a 
practical CA-oblivious PKI-enabled encryption secure under the CDH assump- 
tion (in ROM) , which thus leads to a four-round secret handshake protocol secure 
under CDH. However, since this encryption admits a very practical (in ROM) 
ZK signature of knowledge of the private key, which is simply the Schnorr sig- 
nature scheme itself, this res ults in a s ecret handshake scheme which takes three 
rounds, like the scheme of |BDS + 03] . and which involves one multiexponenti- 
ation and one or tw o exponentiations per player. Compared to the cost of the 
scheme of [BDS + 03] , where each player computes a pairing of two elements one 
of which is known in advance, this is about twice less expensive, according to 
the results of Barreto et al. |BKLS02| . 

We also improve the functionality of a secret handshake system by showing 
that our CDH-based SH schemes support “blinded” issuance of the member 
certificates in the sense that the CA does not learn the trapdoors i ncluded in 
the certificate, and thus, in contrast to the BDH-based SH scheme of |BDS + 03] , 
the CA cannot impersonate that member. 

Finally, we note that the CA-oblivious encryption we devise can be also 
applied to provide a CDH-based solution to the Hidden Credentials problem 
|HBSQ03j . which generalizes the notion of secret handshakes to general PKI 
trust evaluations where two communicating partners are not necessarily certified 
by the same group/certification authority. This problem was also given only a 
BDH-based solution so far, in |HBSOf)3j . 

Related Work. As described in |BDS + 03] , existing anonymity tools such as 
anonymous credentials, group signatures, matchmaking protocols, or accumu- 
lators, have different goals than secret handshakes, and it is indeed unclear how 
to achieve a secret handshake scheme from any of them. Thus we will briefly 
discuss here only the new work of |LDB03| . which proposes a new notion “obliv- 
ious signature-based envelopes” , which is closely related to the secret handshake 
problem. The oblivious envelope notion they define is very similar to our notion of 
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PKI-enabled encryption, but with a weaker obliviousness property. Namely, they 
only require that the encrypting party does not know if the receiver possesses a 
CA-certified public /private key or not, but the protocol does not hide the iden- 
tity of the CA itself from the receiver. In contrast, our CA-oblivious encryption 
notion requires the protocol to hide this identify. Thus, while our CA-oblivious 
encryption gives an oblivious signature-based envelope for Schnorr signatures, 
the other direction is not clear. In particular, it remains an open problem if 
CA-oblivious encryption and/or secret handshakes can be constructed based on 
the RSA assumption^ 

Organization. In section |2] we revise the definitions of an SH scheme |BDS + 03~] . 
restricting them to “PKI-like” SH schemes we consider here. In section 0 we 
define the notion of a PKI-enabled encryption , and the C A- obliviousness property 
for such encryption. In section ED we construct a CA-oblivious encryption secure 
under CDH in ROM. In section[5]we give two general constructions of SH schemes 
from any CA-oblivious encryption. In appendix E] we show how to support roles 
and blinded issuing of CA certificates. 


2 Definition of Secret Handshakes 

We adapt the definition of a secure Secret Handshake [SH] scheme from [BDS + fl3] 
to what we call “PKI-like” SH schemes. Our definitions might potential ly restrict 
the notion of a secret handshake scheme, but both the SH scheme of |BDS + 03| 
and our SH schemes fall into this category. We define an SH scheme as a tuple 
of probabilistic algorithms Setup, CreateGroup, AddMember, and Handshake s.t. 

— Setup is an algorithm executed publicly on the high-enough security parame- 
ter k, to generate the public parameters para ms common to all subsequently 
generated groups. 

— CreateGroup is a key generation algorithm executed by a GA, which, on input 
of params, outputs the group public key G, and the GA’s private key tc- 

— AddMember is a protocol executed between a group member and the GA on 
GA’s input to and share d inputs: params, G, and the bitstring ID (called a 
pseudonym in |BDS + 03] 1 of size regulated by params. The group member’s 
private output is the trapdoor t produced by GA for the above ID. 

— Handshake is the authentication protocol, i.e. the SH protocol itself, executed 
between players A, B on public input ID A ,ID B , and params. The private 
input of A is (t A , G A ) and the private input of B is (t B , G B ). The output of 
the protocol for either party is either a reject or accept. 

We note that AddMember can be executed multiple times for the same group 
member, resulting in multiple (ID, t ) authentication tokens for that member. We 


5 In the poster advertising the preliminary version of these results in PODC’04, we 
erroneously claimed that we know how to get RSA-based CA-oblivious encryption 
scheme, but this claim was incorrect, and this issue is still an open problem. 
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also note that in all the SH schemes discussed here the output of the Handshake 
protocol can be extended to include an authenticated session key along with the 
“accept” decision. 

2.1 Basic Security Properties 

An SH scheme must be complete, impersonator resistant, and detector resistantH 

Completeness. If honest members A,B of the same group run Handshake with 
valid trapdoors tA,tB generated for their ID strings ID a , ID B and for the same 
group Ga = Gb, then both parties output “accept”. 

Impersonator Resistance. Intuitively, the impersonator resistance property is vi- 
olated if an honest party V who is a member of group G authenticates an adver- 
sary A as a group member, even though A is not a member of G. Formally, we 
say that an SH scheme is impersonator resistant if every polynomially bounded 
adversary A has negligible probability of winning in the following game, for any 
string IDy which models the ID string of the victim in the impersonation attack: 

1. We execute params <— Setup(l fc ), and ( G,tG ) *— CreateGroup(params). 

2. A, on input ( G,IDy ), invokes the AddMember algorithm on any number of 
group members IDj of his choice. (The GA’s inputs are IDi s, G, and to-) 

3. A announces a new IDa string, different from all the IDi’s above. (This 
models a situation where the IDi s belong to group members who are mali- 
cious but who might be revoked.) 

4. A interacts with the honest player V in the Handshake protocol, on com- 
mon inputs (IDa, IDy), an d on V’s private inputs G and ty, where ty <— 
AddMember((G, IDy), to). 

We say that A wins if V outputs “accept” in the above Handshake instance. 
We note that the above impersonator resistance property is rather weak, 
and that stronger versions of this property are possible, and indeed advisable. 
Namely, the attacker should be allowed to run the protocol several times against 
V, and be able to ask for additional trapdoors after each attempt, before he 
announces that he is ready for the true challenge. Also, the attacker could be al- 
lowed to ask for trapdoors on additional IDi ^ IDa strings during the challenge 
protocol with V. We adopt the simplest and weakest definition here to reduce 
the level of formalism in the paper. Nevertheless, we believe that our schemes 
remain secure under these stronger notions as well. 

Remark: We note that even such strengthened notion of impostor resistance is 
not strong enough to be used in practice. For example, the resulting notion 


6 Once we restrict the notion of SH schem es to the PKI-like SH schemes, the security 
properties defined originally in |BDS + 03] can be stated in a simpler way. Specifically, 
their properties of impersonator resistance and impersonator tracing are subsumed 
by our impersonator resistance, and their detector resistance and tracing is subsumed 
by what we call detector resistance. 
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makes no claims of security against the man in the middle attacks, and no 
claims if the adversary triggers a handshake protocol with an honest owner of 
the ID a identity at any time before the adversary tries to authenticate himself 
to V under this identity. Therefore we do not claim that the above impostor 
resistance property is sufficient in practice. Instead, the above authentication- 
like notion of impostor resistance has to be first extended to Authenticated Key 
Agreement [AKE]. We discuss this further in the Section (T2l below. 

Detector Resistance. Intuitively, an adversary A violates the detector resistance 
property if it can decide whether some honest party V is a member of some group 
G, even though A is not a member of G. Formally, we say that an SH scheme 
is detector resistant if there exists a probabilistic polynomial-time algorithm 
SIM, s.t. any polynomially bounded adversary A cannot distinguish between 
the following two games with the probability which is non-negligibly higher than 
1/2, for any target ID string IDy. 

Steps 1-3 proceed as in the definition of Impersonator Resistance, i.e. on 
input IDy and a randomly generated G, A queries GA on adaptively chosen 
IDf s and announces some challenge string ID a, ID .4 ID, for all i. 

4-1. In game 1, A interacts with an algorithm for the honest player V in the 
Handshake protocol, on common inputs ( ID a, ID y ), and on V’s private 
inputs G and t v = AddMember((G, ID v ),ta). 

4-2. In game 2, A interacts with SIM on common inputs (/.E/4, IDy). 

5. A can query GA on additional strings ID., ^ ID .4. 

6. A outputs “1” or “2” , making a judgment about which game he saw. 
Similarly to impersonator resistance, stronger notions of detector resistance 

are possible and indeed advisable. In particular, the adversary should be able to 
trigger several executions of the handshake protocol with player V, and he should 
be able to interleave these instances with instances executed with the rightful 
owner of the ID ^ identity. We adopt the above weak notion for simplicity, but 
our schemes satisfy these stronger notion as well. 

2.2 Extensions and Other Security Properties 

Authenticated Key Exchange. As mentioned in the previous section, the impos- 
tor resistance property defined above is only a weak authentication-like property 
which does not give sufficient guarantees in practice. Moreover, in practice one 
would like to extend the notion of a secret handshake from one where partic- 
ipants’ outputs are binary decisions “accept” / ’’reject”, to authenticated key 
exchange, where parties output instead either “reject” or a secure session key. 
We believe that the SH schemes we propose, just like the original SH protocol 
of [BDS+03] . can be easily extended to AKE protocols using the standard AKE 
protocol techniques. However, the formal security analysis of the resulting proto- 
cols requires adoption of AKE formalism |BR931ICK02HSlio99| , which is beyond 
the scope of this paper. 
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Group- Affiliation Secrecy Against Eavesdroppers. Our schemes also protect 
secrecy of participants’ group affiliations against eavesdroppers, even if the eaves- 
dropper is a malicious member of the same group. An observer of our SH proto- 
cols does not even learn if the participants belong to the same group or not. We 
do not formally define security against eavesdroppers, because it is very similar 
to the security against active attackers which we do define, the impersonator 
and detector resistance. Moreover, if the protocol participants first establish a 
secure anonymous session, e.g. using SSL or IKE, and then run the SH protocol 
over it, the resulting protocol is trivially secure against eavesdroppers. 

Unlinkability. A potentially desirable property identified in |BDS + 03] , is unlink- 
ability, which extends privacy protection for group members by requiring that 
instances of the handshake protocol performed by the same party cannot be 
efficiently finked. This can be achieved trivially (but inefficiently) by issuing to 
each group member a fist of one-time certificates, each issued on a randomly 
chosen ID, to be discarded after a single use. Unfortunately, an honest mem- 
ber’s supply of one-time certificates can be depleted by an active attacker who 
initiates the handshake protocol enough times. Indeed, while one can rim our 
SH schemes using multiple certificates to offer some heuristic protections against 
finking, constructing an efficient and perfectly unlinkable SH scheme remains an 
open problem. 

3 Definition of PKI-Enabled CA-Oblivious Encryption 

We define the notion of PKI-enabled encryption, which models the use of stan- 
dard encryption in the context of a PKI system, and also generalizes Iden- 
tity Based Encryption. We define one-way security for PKI-enabled encryption, 
adapting a standard (although weak) notion of one-way security of encryption to 
our context, and we define a novel C A- obliviousness property for such schemes. 

A PKI-enabled encryption is defined by the following algorithms: 

— Initialize is run on a high-enough security parameter, k, to generate the pub- 
lic parameters params common to all subsequently generated Certification 
Authorities (CAs). 

— CAInit is a key generation algorithm executed by a CA. It takes as inputs 
the system parameters params and returns the public key G and the private 
key to of the CA. 

— Certify is a protocol executed between a CA and a user who needs to be 
certified by this CA. It takes CA’s private input to, and public inputs G 
(assume that G encodes params) and string ID which identifies the user, 
and returns trapdoor t and certificate oj as the user’s outputs. 

— Recover is an algorithm used by a sender, a party who wants to send an 
encrypted message to a user identified by some string ID, to recover that 
user’s public key. It takes inputs (G, ID, ui) and outputs a public key PK. 

— Enc is the actual encryption algorithm which takes inputs message m and 
the public key PK (assume that PK encodes params and G), and outputs 
a ciphertext c. 


Secret Handshakes from CA-Oblivious Encryption 301 


— Dec is the decryption algorithm which takes as inputs the ciphertext c and 
the trapdoor t (as well as possibly params, G, ID, and iv, all of which can 
be encoded in t), and returns m. 

The above algorithms must satisfy the obvious correctness property that the 
decryption procedure always inverts encryption correctly. 

It is easy to see (see footnote EJ) that this notion of encryption indeed models 
both regular encryption schemes in the PKI context as well as the Identity Based 
encryption schemes. 

One- Way Security. We define the security of PKI-enabled encryption only in the 
relatively weak sense of so-called one-way security, namely that the attacker who 
does not own a trapdoor for some public key cannot decrypt an encryption of a 
random message. This is a weaker notion than the standard semantic security 
for an encryption, but we adopt it here because (1) it simplifies the definition of 
security, (2) one-way security is all we need in our construction of a secure SH 
scheme, and (3) in the Random Oracle Model, it is always possible to convert 
a one-way secure encryption into a semantically secure encryption, or even a 
CCA-secure encryption using the method of Fujisaki and Okamoto |FQ99| . 

The definition of security for PKI-enabled encryption is very similar to the 
definition of security of an IBE scheme: We say that a PKI-enabled encryption 
scheme is One-Way (OW) secure on message space M. under Chosen-Plaintext 
Attack (CPA), if every polynomially-bounded adversary A has only negligible 
probability of winning the following game: 

1. The Initialize and CAInit algorithms are run, and the resulting public key G 
is given to A. 

2. A repeatedly triggers the Certify protocol under the public key G, on ID 
strings IDi of M’s choice. In each instance A receives (ti,u>j) from the CA. 

3. A announces a pair ( ID a, u>), where ID^ M IDi for all IDi s queried above. 

4. A receives c = Enc/^(m) for a random message m £ M. and PK = 
Recover (G,ID A ,u). 

5. A is allowed to trigger the Certify algorithm on new ID, ID A strings of 
his choice, getting additional ( ti,Ui ) pairs from the CA. 

6. A outputs a message m! . If m' = m then we say that A wins. 

CA-Obliviousness. Informally, PKI-enabled encryption is CA-oblivious if (1) the 
receiver’s message to the sender, i.e., the pair ( ID,uj ), hides the identity of the 
CA which certified this ID; and (2) the sender’s messages to the receiver, i.e., 
ciphertexts, do not leak any information about the CA which the sender assumed 
in computing the receiver’s public key. Consequently, in a standard exchange of 
messages between the receiver and the sender, neither party can guess which CA 
is assumed by the other one. Formally, we call a PKI-enabled encryption scheme 
CA-oblivious under two conditions: 

(I) It is “ Receiver CA-oblivious”, i.e., if there exists a probabilistic polynomial- 
time algorithm SIM s.t. no polynomially-bounded adversary A can distin- 
guish between the following two games with probability non-negligibly higher 
than 1/2, for any target ID string I Dr: 
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1. The Initialize and CAInit algorithms are executed, and the resulting param- 
eters para ms and the public key G is given to A. 

2. A can trigger the Certify protocol on any number of IDi a. 

3-1. In game 1, A gets ( ID r ,uj r ), where u R is output by the Certify protocol on 
G and ID R . 

3- 2. In game 2, A gets ( ID R ,r ) where r = SIMrm (params). 

4. A can trigger the Certify protocol some more on any IDi ^ ID R . 

5. A outputs “1” or “2” , making a judgment about which game he saw. 

(II) It is “Sender C A- oblivious” , i.e., if there exists a probabilistic polynomial- 
time algorithm SIM( R ) s.t. no polynomially-bounded adversary A can distin- 
guish between the following two games, with probability non-negligibly higher 
than 1/2: 

1. The Initialize and CAInit algorithms are executed, and the resulting param- 
eters params and the public key G is given to A. 

2. A can trigger the Certify protocol any number of times, for public key G and 
group members IDi s of A’s choice. 

3. A announces pair (ID R , ui R ) on which he wants to be tested, where ID R ^ 
IDi for all i. 

4- 1. In game 1, A gets c = Enc/>^ R (m) for random rn £ Ai and PK R = 

Recover(G, ID R , w R ). 

4-2. In game 2, A gets c = SIM^ (params). 

5. A can query GA on some more IDi s s.t. V,, IDi A ID R . 

6. A outputs “1” or “2” , making a judgment about which game he saw. 


4 Construction of CA-Oblivious Encryption 

We construct a CA-oblivious PKI-enabled encryption scheme secure based on 
the CDH assumption in the Random Oracle Model 0 

— Initialize picks the standard discrete logarithm parameters ( p , q, g) of security 
k, i.e., primes p, q of size polynomial in k, s.t. g is a generator of a subgroup 
in Z* of order q. Initialize also defines hash functions H : {0,1}* — > Z q and 
H’ : {0, 1}* — * {0, l} k . (Both hash functions are modeled as random oracles, 
but we note that H' is not essential in this construction and can be easily 
removed.) 

— CAInit picks random private key if Z, and public key y = g x modp. 

— In Certify on public inputs ( y,ID ), the CA computes the Schnorr signature 
on string ID under the key y [Sch89] . i.e., a pair (w,t) £ (Z*,Z q ) s.t. g * = 
wy H ( u > ID ) m od p. The user’s outputs are the trapdoor t and the certificate u. 
The signature is computed as u = g r mod p, and t = r + xH(u>, ID) mod q, 
for random r «— Z q . 


7 We remark that since the Identity Based Encryption scheme of IBF01I is also a CA- 
oblivious PKI-based encryption scheme, the SH construction of Section [5] applied to 
that encryption scheme implies efficient BDH-based SH schemes. 
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— Recover (y,ID,oj) outputs PK = modp. 

— Enc pK{fn) is an ElGamal encryption of message m G {0, l} fc under the public 
key PK: It outputs a ciphertext [ci, C 2 ] = [g r mod p, rn CD H'(PK r mod p)\, 
for random r £ h q . 

— Dec is an ElGamal decryption, outputing m = c<i ® H'(c\ mod p). 

Theorem 1. The above encryption scheme is CA-oblivious and One-Way se- 
cure under the CDH assumption in the Random Oracle Model. 

Proof (of One-Way Security). Assume that an adversary A breaks one-wayness 
of this encryption scheme. This means that after receiving n Schnorr signatures 
(ti,uji) on IDfs of his choice, A sends a tuple (ID, tv) s.t. ID A fA for all the 
above IDfs, and (in ROM), to break one-wayness A must query the H' oracle on 
c\ rnodp where g t = ujy H AJ D ) mod p. Therefore, A must exponentiate a random 
element ci it received to the exponent t. Hence, what we need to argue that, 
even though A receives n signatures up) on her IDfs, she cannot produce a 
new pair (ID, u ) s.t. she can exponentiate a random elements c\ to exponent t 
where g f = w * y h ( u ’ ID ) . Now, this is very similar to proving the chosen message 
attack security of the underlying Schnorr signature scheme, where one argues 
that, after receiving n signatures, A cannot produce a new triple (ID, u>, t) s.t. 
g f ' = oj * y h ( 0J ' ID ) , Hence, our proof is very similar to the forking-lemma proof 
for Schnorr signature security in |PS96] . However, here we reduce the successful 
attack not to computing discrete logarithm, but to breaking the CDH assumption 
by computing m x on input y = g x and a random value m. 

To reduce M’s ability to succeed in this protocol to computing m x on the 
Diffie-Hellman challenge (g,g x ,m), we first simulate, as in the proof of Schnorr 
signature security, the signatures (ti,uf) that A gets on her IDfs, by taking 
random U,Ci, computing up = g t( * y~ Ci modp, and assigning H(ui,, ID,) to 
Ci . Since the verification equation is satisfied and tj,c, are picked at random, 
this is indistinguishable from receiving real signatures. Then, as in the forking 
lemma argument of |PS96] , we can argue that if M’s probability of success is e, 
the probability that M executed twice in a row succeeds in both executions and 
sends the same (ID,uj) challenge in both of them, is at least e 2 /qh where cp, is 
the number of queries M makes to the hash function H (see |PS96| ). The forking 
lemma used in the security proof of the Schnorr signature scheme shows that if 
two conversations with an adversary produce triples (t,u>,ID) and (t',u>,ID), 
where in first conversation H(uj,ID) = c and in the second H(ui, ID) = d for 
some random c, d , then x = DL g (y) can be computed as x = (s— s')/ ( c—d ) mod 
q, because g f = uj * y c and g f ’ = us * y c . By applying the same forking lemma 
to our case, adversary M produces two exponentiations rrf and m* , instead of 
forgeries t, t' , but still we have that x = DL g (y) = (t — t')/(c — d). Therefore, 
with probability e 2 /qn we can break the CDH challenge and compute m x = 
m p-t')/(c-c') = moc lp. 

Note that if the success probability e is higher than negligible, and if M* is 
an efficient algorithm and hence the number of queries qh is polynomial, then 
the probability of CDH break e 2 /qh is non- negligible as well. 
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Proof (of G A- Obliviousness) . It is easy to see that neither u) nor the ciphertext 
C = [ci,C 2 ] reveal any information about the CA: Since oj = g r for random r, 
ui is independent from CA’s public key y, and hence the scheme is receiver CA- 
oblivious. Ciphertext C = fcj,, 03 ] on a random message m is also independent 
from the group key y, because ci = g r for random r and C 2 is computed by 
xoring H'(PK r ) with the random m. 


5 Secret Handshakes from CA-Oblivious Encryption 

We first show how to built a secure four-rounds SH scheme using CA-oblivious 
PKI-enabled encryption. Given a CA-oblivious one-way secure PKI-enabled 
encryption scheme (Initialize, CAInit, Certify, Recover, Enc, Dec), and a hash 
function H : (0, 1}* — * {0, l} k modeled as a random oracle, we specify a secret 
handshake scheme as follows: Algorithms Setup, CreateGroup, and Add Member, 
are simply set to Initialize, CAInit, and Certify, respectively, while algorithm 
Handshake proceeds as follows. A’s inputs are {ID a . uj a . t„) and B's inputs are 

(ID b ,u b ,t b ) @ 

1. ( B — * A): ID b, u>b 

- A obtains PK b = Recover (G, ID b , uj b ) 

- A picks r a <— M and ch a <— {0, l} fc 

- A computes C a = Enc PKb (r a ) 

2. (A — » B): ID a , u a , C a , ch a 

- B obtains PK a = Recover (G,ID a ,u) a ) 

- B obtains r a = DeQ 6 (C a ) 

- B picks r b <— M. and ch b <— (0, l} fe 

- B computes C b = Enc pK a {r b ) 

- B computes resp b = H (r a , r b , ch a ) 

3. ( B — * A): C b , respb, ch b 

- A obtains r b = Dec ta (C b ) 

- if respb i=- H(r a ,rb,ch a ), A outputs FAIL; otherwise A outputs ACCEPT. 

- A computes resp a = H(r a ,rb,chb ) 

4. (A — > B) : respa 

- if resp a H(r a , r b , ch b ), B outputs FAIL; otherwise B outputs ACCEPT. 

We note that the above protocol can be easily turned into an Authenticated 
Key Exchange (AKE) protocol (secure in the ROM model) if the two parties 
compute their authenticated session key as K = H(r a , r b ). 

Theorem 2 . If the PKI-enabled encryption is CA-oblivious and One-Way se- 
cure, the above construction yields a Secret Handshake scheme secure in the 
Random Oracle Model (ROM). 


Group member’s trapdoor on string ID in this SH scheme is a pair [to, L) produced 
by the Certify protocol. We can also assume that ( ID a ,ID b ) are public inputs. 
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Proof (of Impersonator Resistance). Assume that A violates with non-negligible 
probability e the impersonator resistance property against some honest member 
V identified by ID V . Assume that A plays the role of A and V plays the role of B 
(the other case is easier because B has to speak first). Therefore with prob. e, A 
sends a valid resp a = H(r a ,rb, chb) response to B. In the ROM model, that can 
happen with non-negligible probability only if A querries the oracle for H(-) on 
the input (r a , rj,, chb) s.t., in particular, rb was the value picked by V and sent to 
A in the form of a ciphertext Cb = Enc pK a (fb) for PK a = Recover (G,ID a ,u} a ), 
where (ID a ,u> a ) are sent by A in its first message to V. Therefore, in ROM, we 
can use A to create a break A! against the one-way security of the encryption 
scheme: 

On input G, A! passes the public key G to A. When A can makes a querry 
IDi, so does A', passing back (&%,£,) to A. When A announces that he is ready 
for the impersonation challenge against V, A! passes as his encryption challenge 
the pair ( ID a ,u> a ) sent by A in his first message to V. On encryption challenge 
c = Enc PK a (m) where m is chosen at random in M , A' passes the same challenge 
as its response Cb = c to A, together with a random challenge value chb and 
respb picked at random. The only way A can tell between this communication 
and a conversation with an honest V is by querying H on ( r a ,rb,ch a ) for = 
Dec to (C'b) = m. Otherwise, as we argued above, he queries H on ( r a ,rb,chb ) 
with probability almost e. In either case, since A can make only polynomially- 
many queries to H, A! can pick one such query at random, and A! will have a 
non-negligible chance of outputing rb = m. Thus A! breaks the one-wayness of 
the encryption scheme. 

Proof (of Detector Resistance). We will show a simulator SIM s.t. if A distin- 
guishes between interactions with SIM and interactions with a group member, 
we can break the one-way security of the encryption scheme. Assume again that 
the adversary A plays the role of A and V plays the role of B. Assume that the 
underlying encryption scheme is CA-oblivious, and therefore there exist sim- 
ulators SIM(s) and SIM( R) which satisfy the two CA-obliviousness criteria. 
We define a simulator SIM, running on input (ID A , ID V , params), as follows: 
(1) To simulate V’s first message SH-1, SIM sends ID h = ID V together with 
u>b = (params), (2) To simulate B’s second message SH-3, SIM sends 

respb and chb picked at random, and Cb — SIM( S ) (params). 

If A can distinguish a conversation with such SIM from a conversation with 
a true group member V, then by a standard hybrid argument, since the SIM(g) 
and SIMrjq simulators produce messages which are indistinguishable from the 
messages of an honest B, it must be that A distinguishes random values respb 
chosen by SIM from values respb = H(r a ,rb,ch a ) computed by a real player. 
But this can happen only if A makes an oracle query on the triple (r a , r;,, ch a ), 
in which case we can use A, exactly in the same manner as we did in the proof 
of impersonator resistance, to attack the one-way security of the underlying 
encryption scheme. 
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5.1 Three-Round Secret Handshake Scheme 

We can eliminate one communication round in the above protocol using the zero- 
knowledge signature of knowledge |CS97| of the trapdoor t that corresponds to 
the public key PK = Recover (G,ID,lo), which we will denote sig t (m). One can 
easily construct such signatures in ROM if this relation admits a 3-round honest- 
verifier special-soundness proof system |CS97j . The protocol proceeds as follows, 
using the same notation as above: 

1. (B — > A): ( ID b ,u b ,ch b ) 

- A computes PKb = Recover (G,IDb,u>b) and e= Enc pK h (r a , sig ta (chb)) 

2. {A — > B): (ID a ,u> a ,cha a ,c) 

- B accepts if c decrypts to (r a , sig) where sig verifies as a signature on chb 

under the public key PK a = Recover (G,ID a ,u) a ) 

3. ( B — > A): respb = H(r a , ch a ) 

- A accepts if resp b = H(r a , ch a ) 

In the case of the CDH-based encryption of Section HJ the above signature of 
knowledge is simply a Schnorr signature, and the resulting computational cost 
is one or two exponentiation and one multiexponentiation per player. 
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A Achieving Additional Properties 

A.l Roles 

Our sche mes can eas ily be extended to handle group member roles (as in the SH 
scheme of |BDS + 03j ). in a way that a member can choose not to reveal anything 
about herself unless the other party is a member with a particular role r (and 
vice versa). This functionality can be provided by modifiying the Add Member 
and Recover procedures as follows: 

- AddMember: takes as inputs params, G, t G and an arbritary string ID G 
{0, 1}* and returns {to, t) where t is a trapdoor and w is a public parameter, 
(w, t) are constructed using the string I D\r (instead of ID as in the original 
procedure), where r is the role that the CA is assigning to the user. 

- Recover: takes as input params, G, ID and uj (provided by another user B). 
It outputs a public key PK using as input ID\r (instead of ID as in the 
original Recover procedure), where r is the role that A chooses to have a 
secret hanshake with. 

A. 2 Trapdoor Secrecy 

Since CA computes the user’s trapdoor t, it can impersonate that user. Would 
that be problematic, AddMember can easily be modified to blind the trapdoor if 
in the AddMember protocol the user supplies the CA with b = g s mod p, where 
6 is the user’s temporary secret. The CA can then reply with uj = g k *b mod p, 
where k is a random value in Z g , and t' = k + H(ui, ID) * to mod q, and the user 
computes his trapdoor as t = t’ + 6 mod q. 
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Abstract. We propose an authentication scheme in which users can be 
authenticated anonymously so long as times that they are authenticated 
is within an allowable number. The proposed scheme has two features 
that allow 1) no one, not even an authority, identify users who have been 
authenticated within the allowable number, and that allow 2) anyone to 
trace, without help from the authority, dishonest users who have been 
authenticated beyond the allowable number by using the records of these 
authentications. Although identity escrow/group signature schemes allow 
users to be anonymously authenticated, the authorities in these schemes 
have the unnecessary ability to trace any user. Moreover, since it is only 
the authority who is able to trace users, one needs to make cumber- 
some inquiries to the authority to see how many times a user has been 
authenticated. Our scheme can be applied to e-voting, e-cash, electronic 
coupons, and trial browsing of content. In these applications, our scheme, 
unlike the previous one, conceals users’ participation from protocols and 
guarantees that they will remain anonymous to everyone. 


1 Introduction 

1.1 Background 

Many applications, such as e- voting [THJ 1211 123 12HHH2L e-cash [T1 121 IT21 1151150] . 
electronic coupons [251 1251 125] , and trial browsing of content, often need to al- 
low users to anonymously use these to protect privacy. At the same time, these 
applications need to restrict the number of times users can use them. These ap- 
plications have three common requirements. The first is that they should provide 
honest users as much privacy as possible. The second is that they should be able 
to trace dishonest users easily. The third is that they should be able to restrict 
the number of times users can use applications. 

However, if an application provider authenticates each user by receiving the 
user’s signature when the user accesses it, a problem arises in that the provider 
is able to know who is using the application. 

By following the authentication procedure of an identity escrow/group signa- 
ture scheme [2]li]l5]ITllT5 ] l21 1 l22] ■ instead of an ordinary authentication scheme, 
users can be authenticated by the application provider without revealing their 
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ID to it. However, this method also does not fully satisfy all the requirements. 
First, an authority called the group manager can identify honest users. Second, 
providers needs to make cumbersome inquiries of the group manager to trace dis- 
honest users. Third, there is no easy way for the provider to restrict the number 
of times users can use applications. 

1.2 Properties of Proposed Scheme 

We propose an authentication scheme called k- times anonymous authentication 
(fc-TAA) that satisfies the three requirements mentioned in the previous sec- 
tion. An authority called the group manager first registers users in the proposed 
scheme. Each application provider(AP) then publishes the number of times a 
user is allowed to use their application. The registered users can be authenti- 
cated by various APs. 

The proposed scheme satisfies the following properties: 

1. No one, not even the group manager, is able to identify the authenticated 
user, if authenticated user is honest. 

2. No one, not even the group manager, is able to decide whether two authen- 
tication procedures are performed by the same user or not, if the user(s) 
is /are honest. 

3. Any user who was accurately detected as having accessed more than the al- 
lowed number of times can be correctly traced using only the authentication 
log of the AP and public information. 

4. No colluders, not even the group manager, are able to be authenticated by 
an AP provider on behalf of an honest user. 

5. Once a user has been registered by the group manager, the user does not 
need to access the group manager. 

6. Each AP can independently determine the maximum number of times a 
registered user can anonymously access the AP. 

We stress that the group manager of our scheme has less authority than one 
of an identity escrow/group signature scheme. He cannot trace honest users. His 
sole role is registering users. 

The proposed scheme also has directly uses as a k-times anonymous signature. 
We formalize security requirements of fc-TAA, then prove that the proposed 
scheme is secure under strong RSA assumption and DDH assumption. 

1.3 Comparison with Related Work 

Using known schemes, one can construct a scheme that has similar properties to 
ours. However, these schemes have some problems. 

Blind Signature Scheme. Using the blind signature scheme [13], one can con- 
struct a scheme that has similar properties to ours. In each authentication, a 
user receives the group manager’s blind signature and sends this signature to an 
AP. The AP accepts the authentication if the signature sent is valid. However, 
the scheme does not work well when there are multiple APs and their allowed 
number of access times is more than one. 
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Electronic Cash That Can be Spent k-times. Using multi-show cash [9] (i.e., 
electronic cash that one can spend multiple times), we can construct another 
scheme that has similar properties to ours. The group manager plays the role 
of the bank. Before accessing an AP for the first time, a user asks the bank to 
give him digital cash that can be spent k times, where k is the number of the 
access times allowed by the AP. This cash plays the role of a ticket that allows 
users to access the AP, i.e., users send the digital cash to the AP when they are 
authenticated by the AP. 

This scheme, however, has three drawbacks. First, the scheme is not efficient 
in the sense that users must access the group manager every time they access 
a new AP. Second, the group manager can learn which APs each user wants to 
be authenticated by. Third, one can determine whether two payment protocols 
have been performed by the same user or not by comparing the multi-show cash 
that was used in the protocols. 

Electronic Coupon. By using electronic coupons m as tickets, instead of elec- 
tronic cash, one can construct another scheme, which also has similar properties 
to ours. This scheme, however, has the same problems that identity escrow/group 
signature schemes have. That is, the group manager can trace honest users, and 
an AP needs to make cumbersome inquiries of the group manager to trace dis- 
honest users. The scheme also has a problem in that one can sometimes determine 
whether two authentication procedures have been performed by the same user 
or nolQ. 

List Signature and Direct Anonymous Attestation. Independently proposed 
schemes [5] and m are similar to ours. However, these schemes are unmatched 
to our purpose. 1) These scheme cannot use two or more times signature. 2) 
A verifier of [3] cannot trace dishonest user without help of an authority. The 
scheme EU has no way to trace dishonest user. 3) An authority of [5] can identify 
the authenticated user. 

1.4 Applications 

An example of an application of the fc-TAA is trial browsing of content. Each 
provider wants to provide users with a service that allows them to browse content 
such as movies or music freely on trial. To protect user privacy, the providers 
allow users to use them anonymously. To prevent users from using the service 
too many times, the providers want to restrict the number of times that a user 
can access the service. 

This privileged service is only provided to certain group members, say a 
member of the XXX community. The head of this community plays the role of 
the group manager, and registers users on behalf of providers in advance. 


Although the authors of [25] claim that no one can determine this, it does not. The 
reason is nearly same as that Zc-TAA scheme which an AP is able to know how many 
times users accesses to him. See 1) of !3.4l 
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The properties of the proposed scheme enables all honest users to browse 
content anonymously for an permitted number, but users who access beyond 
the allowed number of times are identified. 

It can also be applied to voting, transferable cash, and coupons. In the one- or 
multiple- voting scheme constructed with the proposed scheme, a voter computes 
one- or fe-times anonymous signatures on his ballot, and sends these anonymously 
to an election administrator. In this scheme, even authorities are unable to know 
whether a user has voted or not. 

We can add transferability to the electronic cash scheme [5] with our scheme. 
To transfer cash to another entity, the owner of the cash computes a one-time 
anonymous signature on the electronic cash, and sends it with the signature to 
the receiver. Although a transferable electronic cash scheme has already been 
proposed in m, our scheme has an advantage in that users does not need to 
access the bank each time they transfers cash to another entity. 

One can construct an electronic coupon scheme by applying the fc-times 
anonymous signature scheme directly. Our method has an advantage in that 
even an authority can not trace an honest user while anyone can trace a dishon- 
est user. 

2 Model 

2.1 Entities 

Three types of entities take part in the model, namely, the group manager (GM) , 
users, and application providers (AP). The fc-TAA scheme is comprised of the 
following five procedures: setup, joining, bound announcement, authentication, 
and public tracing. 

In the setup, the GM generates a group public key / group secret key pair, and 
publishes the group public key. Joining is done between the GM and user who 
wants to join the group. After the procedure, the user obtains a member public 
key / member secret key pair. A user who has completed the joining procedure 
is called a group member. 

In the bound announcement procedure, an AP announces the number of 
times each group member is allowed to access him. The AP v publishes his ID,,, 
and the upper bound k v . 

An authentication procedure is performed between a user and an AP. The 
AP accepts the user if the user is a group member and has not accessed him 
more than the allowable times. The AP detects and rejects the user if he is not a 
group member, or if he is a group member but has accessed him more times than 
the announced bound allows. The AP records the data sent by the accepted or 
detected user in the authentication log. 

Using only the public information and the authentication log, anyone can 
do public tracing. The procedure outputs some user ID i, “GM”, or “NO-ONE”, 
which respectively mean “the user i is authenticated by the AP more times than 
the announced bound”, “the GM published the public information maliciously 
” , and “the public tracing procedure cannot find malicious entities” . Note that 
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we allow AP to delete some data from the log. Even if a member has been 
authenticated over the number of times, the tracing outputs NO-ONE if the AP 
deletes data about the member’s authentication. 

2.2 Requirements 

A secure k-TAA must satisfy the following requirements: 

— (Correctness): An honest group member will be accepted in authentication 
with an honest AP. 

— (Total Anonymity): No one is able to identify the authenticated member, 
or to decide whether two accepted authentication procedures are performed 
by the same group member, if the authenticated user(s) has followed the 
authentication procedure within the permitted number of times per AP. 
These are satisfied even if other group members, the GM, and all APs collude 
with each other. 

— (Detectability): Public tracing using an honest AP’s authentication log 
does not output “NO-ONE” , if a colluding subset of group members has been 
authenticated beyond the total number of times each colluding group mem- 
ber is able to be authenticated by the AP. 

— (Exculpability for Users): Public tracing does not output the ID of an 
honest user, even if other group members, the GM, and all APs collude with 
each other. 

— (Exculpability for the GM): Public tracing does not output GM if the 
GM is honest. This is satisfied even if every group members and every APs 
collude with one another. 

Note that these requirements implies the followings: 

— (Unforgeability): Without the help of the GM or group members, no col- 
luding group non-members can be authenticated as group members. 

— (Coalition Resistance) : A colluding subset of group members cannot gen- 
erate a member public key/private key pair, which is not generated in the 
joining procedures. 

— (Traceability): Any member who is detected of having accessed an AP 
predetermined bound can be traced from public information and the AP’s 
authentication log. 

As reasons the unforgeability and the coalition resistance properties are satis- 
fied are almost the same as for the group signature case [7] , we have not included 
an explanation. Traceability property is clearly satisfied. 

3 Proposed Scheme 

3.1 Notations and Terminologies 

Let N and denote the ring of natural numbers and natural numbers from 0 
to 7i — l, and QR(n) be the multiple group of quadratic residues of Z n . Let Hx 
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denote a full domain hash function onto set X. Let PRO OF (x s.t. R(x)) denote 
the proof of knowledge of x that satisfies the relation R(x). We call prime p 
a safe prime if (p — l)/2 is also a prime number. We call n a rigid integer if 
natural number n can be factorized into two safe primes of equal length. Let G 
be a group with known order q, on which DDH problem is hard to solve. For 
simplification, we assume the bit length of q is equal to a security parameter k. 

3.2 Key Ideas 

The proposed scheme is a modification of a group signature scheme. The GM is 
disabled from tracing an honest member, and anyone can identify who accessed 
over a number of times. Say an AP wishes to set the bound at k. Every time a 
member wants to be authenticated by the AP, he computes k intrinsic basis Bi , 
. . ., Bk of AP which is called a tag base, then picks a tag base Bi which he has 
not used before. As long as the member uses different tag bases, he will not be 
identified. However, if he used the same tag base, anyone can identify who used 
the tag base twice. 

3.3 Summary of Proposed Scheme 

Let G be a group on which DDH problems are hard to solve. In the setup, the 
GM publishes a rigid integer n, elements a,ao &u QR(n), and an element b of 
G. 

In joining, the a user and GM compute a member public key/secret key pair 
((A,e),x) such that an equation a x a 0 = A e is satisfied, x and e are elements of 
some previously determined intervals, and e is prime, and add b x and his ID to 
public list, which is called identification list. 

A tag base is a pair (t, t) of elements of the group G. They must be a hash 
values of some data, to prevent to be known the discrete logarithm of each others. 
In each authentication, an AP sends random number l to a member, then the 
member sends back a tag (r, f) = (t x , ( b e t) x ) with a validity proof. If the member 
does not have computed two tags using the same tag base, no one is able to trace 
that user, since DDH problem on G is hard to solve. However, if the member 
computes another tag = (t x , [b e t) x ) using the same tag base, AP can 

search these from his authentication log since these satisfy r = t' , and one can 
compute = b x . Since identification list 

preserves user ID which corresponds b x , one can identify the member. 

3.4 Concerns 

To construct the scheme we propose, we need to consider the followings: 

1) If an AP is able to know, w, the member accesses to him, the total anonymity 
property is not satisfied. Suppose the number of times, w\, that member Mi has 
accessed to an AP does not equals the number of times, W 2 , that member M 2 
has accessed to the same AP. If w /=w\ is satisfied, the AP can affirm that the 
member is not Mi. 

2) If one can know the discrete logarithm of two tag bases, one can identify mem- 
bers using the equation /3 = (f-p Here, ft is a part of the public key 
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of a member, f\ and T2 are second coordinate of tags computed by the member 
using tag bases t\ and G which satisfy 1 2 = t\ z . Similerly, If n Xl = t± X 2 are 
satisfied, a user who know £1 can perform as a user who know X 2 

3) An AP can add false data to the log. 

4) In joining, a secret key x of a member must be selected randomly, since “one 
more unforgeability” of member key pair is assured only if the condition is sat- 
isfied. (See Lemma 0. 

5) In joining, a user must add b x to the identification list before he know ( A , e). If 
a user can know {A, e) before he adds b x , he can stop the joining procedure, and 
get a member key pair (2;, (A, e)) such that b x is not written in the identification 
list. Therefore, he can be anonymously authenticated any number of times since 
b x is needed to tracing procedure. 

6) As a similar reason plain signature schemes needs CA, the proposed scheme 
needs some mechanizm to assure the correctness of the correspondence between 
each entity and his public key. 

7) If G is unknown order group, the number of exponentiations of public trac- 
ing is linear to the size of members. In this case, since one cannot compute 
(f/f') 1 /^^ \ one must cumbersomely compute ) for each element p of 
the identification list and then check whether ) = f/f' is satisfied. 

To avoid attacks of 1), . . ., 5), we construct the proposed scheme which 
satisifes the following: 1) the validity proof conceals w, 2) tag bases are hash 
values of some data, 3) an authentication log contains validity proofs which 
members have computed, 4) x is randomized by the GM, and 5) b x is added to 
the identification list before the GM computes A = (a x ao) 1 ^ e mod n. 

To avoid attacks of 6), we assume the GM’s public key is distributed by some 
trust entity. Additionally, we assume some assumption about the identification 
list, to assuer the correspondence between each member and his public key. See 
14.21 for more detailed discussion. 

To avoid inefficient tracing descibed in 7) , we set G as a known order group, 
especially G f= QRfi). 

3.5 Description of Proposed Scheme 
PARAMETERS 

The security parameters of our scheme are v, e, g, and k. Let A and 7 be 
parameters which are determined by the security parameters. (See Section [5] for 
a detailed description). We set A, T as sets of integers that were in (0, 2 A ) and 
(27, 27 -|- 2 a ) respectively. Let {G K } Ke N be a set of cyclic groups with a known 
order. Let G be G K . 

The parameters v, e, g, and k respectively control the difficulty of solving 
flexible RSA problem (the problem is also called strong RSA problem) on Z„, 
the tightness of the statistical zero-knowledge property, the soundness of the 
scheme, and the difficulty of solving DDH problem on G. We set, for example, 
v = 1024, e = g = k = 160, and set G as an elliptic curve group. 
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SETUP 

1. The GM randomly chooses 2^-bit rigid integer n. Then, it randomly chooses 
/r-bit string Rqm, and computes ((a',a' 0 ),b) = H% n 2 xG (R Gn ) and (a,a 0 ) = 
(a' 2 ,a' 0 2 ) mod n G QR (n) 2 . The group secret key is (pi,P 2 ) and the group 
public key is (n, R GM , a, a 0 , b) . 

JOINING 

1. User Uj selects x' Gu A, and sends its commitment C to the GM with a 
validity proof. 

2. The GM verifies the proof, and sends x" Gu A to Uj. 

3. User U, confirms that x" G A is satisfied, computes x = (( x ' + x") mod 2 A ) 
and (a, (3) = ( a x mod n, b x ), and then adds new data ( i , f3) to the identifica- 
tion list LIST. Then, Uj sends (a, /?) to the GM with a validity proof. 

4. The GM verifies (i, (3) is an element of the identification list, and the proof is 
valid. Then, the GM generates a prime e Gu U, computes A = (crao) 1 /® mod 
n, and sends ( A , e) to user U*. 

5. User Uj confirms that equation a x ao = A e mod n is satisfied, e is a prime, 
and e is an element of U. The new member Uj’s secret key is x, and his 
public key is (a, A, e, fi). 

BOUND ANNOUNCEMENT 

1. AP V publishes (ID V , ky). Here, ID V is his ID. 

Let (ti,ti) = W G 2 (ID V , Aty, 1)> • • ? (AfeviAfev) = H G 2 (ID v , ky, ky). We call 
(t w , t w ) the w-th tag base of the AP. 


AUTHENTICATION 

1. Member M increases counter C'i Dv ,/ cv . If value w of counter C'i Dv ./ cv is greater 
than ky, then M sends _L to V and stops. 

2. AP V sends random integer £ Gu [0, 2 / - i+£ ] n N to M. 

3. Member M computes tag (r, f) = (t* , (b e t w ) x ), using M’s secret key x and 
the ru-th tag base (t w ,t w ), computes proof (r, f) is correctly computed, and 
sends (r, f ) and the validity proof to V. 

4. If the proof is valid and if r is different from all search tags in his authenti- 
cation log, V adds tuple (r, f, £) and the proof to the authentication log LOG 
of V, and outputs accept. 

PUBLIC TRACING 

1. From LOG, one finds two data (r, f, l, PROOF) and (r', t', £' , PROOF') that sat- 
isfy t = t' and l /=£' , and that PROOF and PROOF' are valid. If one cannot 
find such data, then one outputs NO-ONE. 
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2. One computes (3' = (f/f r ) V(^— *0 = = b x , and searches 

pair (i, f3) that satisfies /? = /?' from the identification list. Then, one outputs 
a member’s ID i. If there is no such ( i , /3), then one affirms that the GM has 
deleted some data from the identification list, and outputs GM. 

3.6 Details 

• setup. 

- The GM must additionally publish 1) ( g , h) Eu QR(n) 2 , which shall be used 
by users to compute commitment C in joining, 2) a zero-knowledge proof 
that n is a rigid integer, and 3) a zero-knowledge proof that ( g , h) is an 
element of QR(n). The GM provides the proof 2) using the technique of 
m, and provide the proof 3) by proving knowledge of (<?' , h') G Z n 2 , which 
satisfies ( g /2 , h' 2 ) = (g, h) mod n. 

• joining. 

- At step [U the user must compute ((a'. a' 0 ). b) = H Zti 2 xG (R GM ), and verify 
equation (a, ao) = (a' 2 , dp 2 ) mod n, and the proofs. 

- Commitment C is g x h s mod n. Here s' is a (2v + e)-bit random natural 
number. 

- The formal description of validity proofs of step [T] and |3] are, respectively, 
PROOFi = PR00 F(('e / , s') s.t. x' € A A C = g x h s ' mod n) and PR00F 2 = 
PR00F((5, 9, s'), which satisfies the (a), . . ., (d) below.), where (a) x G A, 
(b) a x = a mod n, (c) Cg x '' = g x {g 2X )^h s ' mod n, and (d) b x = (3. These 
proofs must be statistically zero knowledge on security parameter e. We have 
omitted a detailed description of proofs. See [5] for the proof that committed 
number lies in the interval. 

• authentication. 

- At step|4j if the proof is invalid, V outputs reject and stops. If r is already 
written in the identification list, V adds tuple (t, f, i) and the proof to the 
LOG of the AP, outputs (detect, LOG) and stops. 

- The proof of step [3] is rather more complex. Its details are described in the 
full version of this paper. 

3.7 Efficiency 

The proposed scheme satisfies the followings: 

- (Compactness). The GM is able to add new members to the group without 
modifying any keys which was previously generated. In particular, the size 
of the member’s key pair does not depend on the group size. 

- Once a user has been registered by the GM, the user does not need to access 
the GM. 

- Each AP is able to solely determine the bound of himself. 

- The computational cost of authentication is 0(ky). However, if G is taken 
as an elliptic curve group, the factor which depend on ky is small, since the 
exponentiation on G is faster than that on Z„. 

- The number of exponentiations of public tracing is independent of the size 
of an authentication log and the identification list. 
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3.8 Variants of Proposed Scheme 

1) Although the proposed scheme merely restricts the number of authentications, 
one can construct, using the “and/or”-proof technique, a scheme such as “a trace 
procedure identifies a user if and only if the user is authenticated either 1) k\ 
times from AP Vi or 2) times from AP V 2 and ks times from AP V 3 ”. 

2) By changing a data in LIST from (i, /3) to £p{i)), one can construct 

a fc-TAA scheme in which no one, except a member himself and the GM, can 
detect who is a member of the group. Here, H is a hash function and £ is a 
symmetric encryption scheme. To trace dishonest user, one computes P as in 
the proposed scheme, and then computes H(P), searches (h, e) from LIST that 
satisfies h = H(P), and decrypts e. 

4 Formal Security Requirements 

4.1 Notations 

We describe the five procedures for a fc-TAA scheme as SETUP, JOIN = (£f j Q i N -gm, 
Wjoin-u), BOUND- ANNOUNCEMENT, (abbrev. BD-ANN), AUTH = (W AUT h-u, W AU th-ap), and 
TRACE. The procedures Wjgin-gm and Wjqin-u (resp. Z7 AUT h- A p and W AU th-u) are what 
the GM and user (resp. AP and user) follow in joining (resp. authentication). 
Let (gpk, gsk) and (mpk,msk) denote the public key/secret key pair of group 
manager and member respectively. 

4.2 List Oracle Model 

We must assume the existence of an infrastructure which enables to assure the 
correct correspondence between each member and his public key to formalize 
the security requirements. If we do not assume such thing, no scheme satisfies 
the exculpability properties for users as in a group signature case [7]. One of a 
such infrastructure is a PKI, but a formalization on the PKI model is rather 
complicated, since it must include description of the signing oracle, what an 
adversary can do in a PKI key setup, etc. To simplify, we introduce new model 
list oracle model. In the model, it is assumed the existence of a list oracle (Dlist, 
which manages the identification lislH LIST. The oracle 0 LIST allows anyone to 
view any data of LIST. However, it allows entities to write data (i, mpkj to LIST 
only if the entity is user i or *’s colluder and to delete data of LIST only if the 
entity is the GM or GM’s colluder. We need to stress that even the GM cannot 
write data (i,mpkj) without colluding with the user i, and even user i cannot 
delete data (ijinpkJ without colluding with the GM. A more formal definition is 
described in Figure [TJ where A is a set of entities which collude with an entity 
who accesses to (9 L ist 

Note that a scheme on the list oracle model can be easily transformed into 
a scheme on the PKI model, by changing («,mpkj) to (mpk i5 (mpkj) and LIST 


Although the LIST of the proposed scheme stores a parts of public keys, /3, we deal 
with the case LIST stores the whole public key, to simplify. 
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to (LIST, <7 G m(LIST)). Here, eq(-) is a signature of an entity i. The authority of 
the GM in the list oracle model to delete data from LIST corresponds to the 
authority of the GM in the PKI model to publish (LIST', ^(LIST')) in spite of 
(LIST, £7 GM (LIST)). Here LIST' = LIST \ {(mpk i5 cr^mpkj)}. 

4.3 Experiments 

An adversary is allowed the following in experiments on security properties: 

- If an adversary colludes with the GM, the adversary can maliciously execute 
SETUP and WjoiN-GM(gpk, gsk). 

— If an adversary colludes with a user i, the adversary can maliciously execute 
£GoiN-u(gpk, i) and W A uTH-u(gpk,msk) where msk is a secret key of i. 

- If an adversary colludes with an AP, the adversary can choose the public 
information (ID, k) of the AP and maliciously execute W AUT H- A p(gpk, (ID, /,;)). 
Moreover, the adversary can use different AP information (ID, k) for each 
authentication. 

— An adversary is only allowed to execute many joining and authentication 
procedures sequentially. 

Total Anonymity. An adversary is allowed to collude with the GM, all APs, and 
all users except target users i\ and i-i- It is also allowed to authenticate the oracle 
£Very(&, gpk, ( 11 , 12 ), (ID, k), (d, •)) once only for d = 0,1. If it sends ( d,M ) to 
C> query; oracle Oquery regards M as data sent by a member and executes U kvm - u 
using the key pair of user %®d+i and the APs public information (ID, k). Recall 
that fc-TAA schemes provide anonymity only if a member has been authenticated 
less than the allowed number of times. Therefore, the adversary must authen- 
ticate user i\ or using (ID, k) within k times. If the adversary keeps to the 
rule and outputs b, the adversary wins. See Figure [T] for the formal definition of 
C> query- Here, Squery is a set, using which C> query memorize the session IDs. 

Contrary to [3m], the secret key of the target users is not input to an 
adversary. If the secret keys is input to an adversary, the adversary is able to 
determine b as follows: it colludes with AP publishing (ID, k), authenticated 
k times from the AP using ii’s secret key, and obtains the log LOG for the 
authentications. Then, it communicates with 0 query (&> gpk, (ii, * 2 ), (ID, fc), (0, •)) 
and obtains the log L of the authentications. Secret b equals to 0 if and only if 
TRACE OLIST ( 0 ’')(gpk, LOG U {L}) = i\ is satisfied. 

Detectability. An adversary is allowed to collude with all of group members. If 
the adversary succeeds in being accepted by some AP in more than kn authenti- 
cations, the adversary wins. Here, k is the number of times the AP allows access 
for each user, and n is the number of users who collude with the adversary. 

Exculpability (for users, and for GM). An adversary is allowed to collude with 
all entities except the target entity. If the adversary succeeds in computing the 
log with which the public tracing procedure outputs the ID of the target entity, 
the adversary wins. 
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***Ex p a™ il,i2) ' (m ’ } ’ >)*** 

(gpk, St) ^ - A( 1“) 

b' <- - ^4 O <-l S T({il,«2} o ,-),O J 0i»-»(gP''.-),O* ra -dspk, ).C’q» m YCi>, gpk, (IB, *).(•>•)) (St) 

If (0QUERY has output OVER) Return JL. 

Return b' . 

*** 

Parse M as (command, i, mpk). 

If(command = view and mpk =“-”) 

If( 3 mpk' s.t. (i,mpk') £ LIST) 

Return mpk'. 

If(command = add) 

If(i G X and ^mpk' s.t. (i,mpk) £ LIST) 
LIST <— LIST U {(i,mpk)}. 

Else if(command = delete) 

If (GM £ X) LIST <- LIST \ {(i,mpk)}. 
Return _L. 

***Ex p deciS( w )*** 

(gpk, gsk) <— SETUP(1 W ) 

_4OLI S T({GM} o ,.),O J0IN . G „(gpk,gsk,.),O 1OTH _ AP (gpk,.,.)^ lW ^ 

If ( 3 (ID, k) £ Sauto-ap S.t. #L0GiD,fc > k ■ #LIST) 
Return TRACE® 1 - 15 ^ 0 ’ 0 (gpk, LOG™,*,). 

Return T. 

***Ex p e x £ ul -*»*** 

(gpk, St) <- A( 1“). 

LOG <- ^o LIST ({i 1 }°, ),o J „ IM (gp>=, ),OA m H-o(gp^ )( St ). 
Return TRACE° LIST(0 ’ ) (gpk, LOG). 

***Exp(f£ ul ‘ GM (u>)*** 

(gpk, gsk) e- SETUP (1“) 

LOG <- 

Return TRACE® LIST(0 ’l(gpk,LOG). 

***CW(6, gpk, (n,h), (ID, k)(d, M))*** 
If(d ^ {0, 1}) Return _L. 

If^sid s.t. (d, sid) e 5 qdery) 

Choose new session ID sid 
which has been ever used. 

Squery <— Squery U {(d, sid)}. 

Return 

£huTH-u(gpk, (sid, ii +cw) , (ID, k) M)). 

Comments: 

1. To simplify, we abbreviate 
the hash oracle Oh- 

2. ChuTH-u(gpk, {-,i, ■)) outputs OVER 
if A authenticate user i 

more than allowed number of times. 


Fig. 1. The oracles and the experiments 


Figure [T] denotes the experiments, formally. Ojoin-gm, C>jdin-u, Oauth-u, and 
Oauth-ap are the oracles that manage and execute multiple sessions of Wjoin-gm> 
Z^join-Uj ^auth-u, and Wauth-ap respectively, and oj is the security parameter. The 
set Sauth-ap contains all AP’s information that was used by Oauth-ap, and L0Gi D) /c 
is the log of authentications engaged by Oauth-ap using AP’s information (ID, k). 
See the full version of this paper for a formal definition of the oracles. 

4.4 Definition 

Definition 1. Let oj be a security parameter, A be an adversary, b be an ele- 
ment of { 0,1}, i\ and *2 be natural numbers, and (ID, k) is a some AP’s public 
information. 

7/ Ad v“-((A^b(^})( y ) = |p r (ExpX 7 ? n ' ( °’ Cil ’ i2) ’ (ID ’ fe)) M = 1) 

— Pr(Exp^^ n " < - 1 ’^ 1,l2 ^^ ID ’ fc ^(u;) = 1)| is negligible for security parameter oj for 
all {A, i\, i%, (ID, k)), we say a k-TAA scheme satisfies total anonymity. 

If Adv^ ec * s (w) = Pr(Exp^ e ^ s (u;) = NO-ONE) is negligible for security pa- 
rameter oj for all A, we say a k-TAA scheme satisfies detectability. 
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If Adv^ cu ^ n (w) = Pr(Exp^^ _n (u;) = i%) is negligible for security pa- 
rameter uj for all [A. i\), we say a k-TAA scheme satisfies exculpability for 
users. 

If Adv^ cu - GM ( W ) = Pr(Exp^^ _GM (a;) = GM)) is negligible for security 
parameter uj for all A, we say a k-TAA scheme satisfies exculpability for users. 


5 Security of Proposed Scheme 

To prove the security of the proposed scheme, we use two key lemmata. First, 
since each member generates element a x of QR(n) and element b x of G using 
the same x, we must be particularly concerned about secrecy. We will prove the 
difficulty of a variant in the DDH problem, where two components of a DH-tuple 
are elements of QR(n) and the other two components are elements of G: 

Lemma 1 . (Separation Lemma) Let a be an element o/QR(n), and b be an el- 
ement of G. Then, the following two distributions are statistically indistinguish- 
able: 1 ) the distribution of ( a x mod n, b x ) £ QR(n) X G, where x is randomly 
chosen from A, and 2) the distribution of (a, (3) £ QR(«) x G, where a and (3 
are randomly chosen from QR(rt) and G respectively. 

Since \A\ is e times greater than |QR(n) x G|, the variation distance between 
the two distributions is less than l/2 e , and therefore, Lemma [1] holds. Note 
that, if we injudiciously choose a narrow A, the security of the proposed scheme 
will rely on a non-standard assumption that those two distributions will still be 
computationally indistinguishable. 

Detectability and GM’s exculpability of the proposed scheme depends on 
“one more unforgeability” of a ((A, e),x): 

Lemma 2. If a) a member’s secret key is randomly generated in each joining 
procedure, and if b) for all x £ A and e £ T, x < e is satisfied, then no adversary 
can generate a (x, A, e) which satisfies a x ao = A e , x £ A, and e £ T, and which 
has not been made in the joinings. 

The proof for Lemma [2] is almost same as the proof for Theorem 1 of [2]. 

The proposed scheme satisfies the conditions for Lemma [2] Conditions a) and 
b), respectively, follow the method of choosing x in the joining procedure, and 
the choice of (A, 7). 

Using these lemmata, we can prove the security of the proposed scheme. See 
the full version of this paper for the detailed proof. 

Theorem 1. Let A be 2v+K+e, and 7 be X+p+e+8. Then, the proposed scheme 
on list oracle model satisfies the security requirements of Definition^ under the 
strong RSA assumption, the DDH assumption on {G K }, and the random oracle 
assumption. 
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The XL- Algorithm and a Conjecture from 
Commutative Algebra 
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Essen, Germany 


Abstract. The “XL-algorithm” is a computational method to solve 
overdetermined systems of polynomial equations which is based on a 
generalization of the well-known method of linearization; it was intro- 
duced to cryptology at Eurocrypt 2000. 

In this paper, we prove upper bounds on the dimensions of the spaces 
of equations in the XL-algorithm. These upper bounds provide strong 
evidence that for any fixed finite field K and any fixed c £ N the median 
of the running times of the original XL-algorithm applied to systems of 
m = n+c quadratic equations in n variables over K which have a solution 
in K is not subexponential in n. In contrast to this, in the introduction 
of the original paper on XL, the authors claimed to “provide strong 
theoretical and practical evidence that the expected running time of this 
technique is [. . .] subexponential if m exceeds n by a small number” . 

More precise upper bounds on the dimensions of the spaces of equa- 
tions in the XL-algorithm can be obtained if one assumes a standard 
conjecture from commutative algebra. We state the conjecture and dis- 
cuss implications on the XL-algorithm. 

Keywords: Cryptanalysis, algebraic attacks, overdetermined systems of 
polynomial equations, extended linearization, Proberg’s Conjecture. 


1 Motivation and Introduction 

The security of many cryptographic systems would be jeopardized if one could 
solve certain types of systems of polynomial equations over finite fields. For 
example, it has been pointed out in [5] that one can with a high probability 
recover an AES-128 key from one AES-128 plaintext-ciphertext pair if one can 
solve certain systems with 1600 variables and 8000 quadratic equations over F 2 , 
and it has been pointed out in m that one can achieve the same goal if one can 
solve certain systems with 3986 variables and 3840 (sparse) quadratic equations 
as well as 1408 linear equations over F 2 s. 

Of particular importance for cryptological applications are so-called overde- 
termined (or overdefined) systems of quadratic equations as for example the ones 
we just mentioned. Let us consider a system of quadratic polynomial equations 

fi(X 1 ,...,X n ) = 0, ... ,f m (X u ...,X n ) = 0 , (1) 


P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
© Springer- Verlag Berlin Heidelberg 2004 
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where the fj are polynomials in n indeterminates X \ , . . . , X n over an “effective” 
field K (the field being finite in the cryptological applications) . We say that the 
system is overdetermined if the dimension of the If -vector space generated by 
the fj is greater than n. 

In [7], Courtois, Klimov, Patarin and Shamir propose a computational method 
called extended Linearization (XL) or XL-algorithm to solve such systems of 
polynomial equations (see the next section for a description of the method). In 
the same paper certain heuristics on the running time of this method are stated. 
These heuristics have subsequently been criticized by Moh ([T3]) as being too 
optimistic, and in Sect. 4 of [T3], the method is analyzed with heuristic upper 
bounds on the dimensions on the spaces of equations in the XL-algorithm. As 
however the assumptions on which the heuristic in [131-Sect. 4] relies are not very 
precisely stated, the question whether this heuristic or the original heuristic is 
more credible remained an open problem among cryptologists. In a recent work 
by Chen and Yang ([!]), the heuristic of [Tfil-Sect. 4] is stated as a special case 
of a theorem ([^-Theorem 2])Q However, the proof of |3]-Thearem 2] (and of 
[^-Theorem 7]) has some serious flaws. 

The main purpose of this paper is to show that under the assumption of a 
widely believed conjecture of commutative algebra, one can indeed derive the 
non-trivial upper bounds on the dimensions of the spaces of equations in the 
XL-algorithm conjectured by Moh and stated in [3]-Corollary 6, 1] (see Theorem 
[I] in Sect. [5] for a more general statement). Moreover, we state upper bounds on 
the dimensions of the spaces of equations in the original XL-algorithm which 
can be proven without the assumption of this conjecture. These upper bounds 
provide strong evidence that for any fixed finite field K and any fixed c £ N the 
median of the running times of the original XL-algorithm applied to systems of 
m = n + c quadratic equations in n variables over K which have a solution in 
K is not subexponential in n (see the next section for details). 

2 The XL- Algorithm and Our Analysis 

Let us fix the system of quadratic equations (|TJ) which we assume to have a 
solution in K and some D £ N. The main idea of the XL-algorithm is to try to 
solve (jTJ) by linearization of the system of all polynomial equations 
k 

l[X it -f j (X 1 ,...,X n )=0, (2) 

£=1 

where k < D — 2. 

Let Ud be fv -vector space generated by the polynomials flfLi Xu ' fj with 
k < D - 2. 

According to [TJ-Definition 1], the XL-algorithm is as follows. (Except for 
changes in the notation, the description is verbatim.) 


1 Theorem 2 of [4] is equivalent to the heuristics of [13] if D < q as can be seen by 
expanding the polynomial in item 1 of Corollary 6 in [3] . 
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The XL-Algorithm. Execute the following steps: 

1. Multiply: Generate all the products JX^ =1 • fj € Ud with k < D — 2. 

2. Linearize: Consider each monomial in Xi of degree < D as an independent 
variabl^ and perform Gaussian elimination on the equation obtained in 1. 
The ordering on the monomials must be such that all the terms containing 
one [specific] variable (say X%) are eliminated last. 

3. Solve: Assume that step 2 yields at least one univariate equation in the pow- 
ers of X i. Solve this equation over the finite fields (e.q. with Berlekamp’s 

algorithmM 

4. Repeat: Simplify the equations and repeat the process to find the values of 
the other variables. 

Remark 1. In the description of the method in [7], it seems that D is fixed 
beforehand. As the authors do however not say how D should be determined, 
it seems to be reasonable to assume that the authors of [7] had in mind that 
D is in fact a variable which is small (e.g. 2) in the beginning, and that the 
the XL-algorithm goes to Step 1 with an incremented D whenever in Step 3 no 
univariate equation in X\ with a solution in K is found. 

Remark 2. In an “extended version” ([6]) of [7], the description of the method is 
the same as the one in [7] (and the one we present here) except that the authors 
have inserted the sentence “In all the following notations we suppose the powers 
of variables taken over K, i.e. reduced modulo q to the range 1, ... .q — 1 because 
of the equation a q = a of the finite field K .” after the third paragraph of Sect. 
3. (But the field is not assumed to be finite in the second paragraph of Sect. 
3 and the number q is not mentioned before.) Apart from this insertion, there 
is no substantial difference between Sect. 3 to 7 of [7] and of [B]. Of course, if 
one identifies the monomials n^=i Xi t anf l X q ■ J^ =1 W, the method becomes 
much faster if q, the field size, is small, q = 2,3,4, 5 say. According to the way 
the heuristics in Sect. 6 of [7] and [6] were conducted, this identification was 
however not made in the heuristic analysis of [7] and [B]. 

Definition 1. We call the above computational method the original XL-algo- 
rithm. The variant introduced in Jjj|/ is called reduced XL-algorithm. 

Remark 3. Whereas the original XL-algorithm should only be applied to overde- 
termined systems of (quadratic) polynomial equations, if the field is finite and 
not too large, it makes sense to apply the reduced XL-algorithm to any system 
of (quadratic) polynomial equations. 


2 The authors of [7] obviously mean that each monomial of degree < D should be 
considered as a new variable. 

3 Note however that according to the second paragraph in [3-Sect. 3], the ground field 
is not necessarily finite. 

4 It should be avoided to repeatedly select univariate polynomial equations which 
have more than one solution in K. Moreover, if a univariate polynomial equation is 
found which does not have a solution in K, the method should terminate and output 
“unsolvable” . 
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Remark 4 • Neither of the two computational methods terminates for every input 
(even if they are only applied to overdetermined systems which have a solution 
in K ); thus in contrast to their names, they are not algorithms (not even ran- 
domized algorithms) in the usual sense (cf. [Til-Chapter 1, 1.1]). 

As we will see in the next section, there is a strong connection between the 
original and the reduced XL-algorithm (see Proposition [TJ . Because of this con- 
nection, one can use an analysis of (a generalization of) the original XL-algorithm 
to analyze also the reduced XL-algorithm (see Theorem [T] and Corollary [TJ) . In 
order to state the main ideas of our analysis and to compare our results with the 
conjectures of [7], in this section, we concentrate on the original XL-algorithm. 

For D £ N, let K[X \, . . . ,X„]<p be the if -vector space of polynomials in 
X \ , . . . , X n of (total) degree < D, and let 

X (D) := dim K (K[X lt . . -,X n )< D ) - dim K (U D ) . (3) 

One can surely obtain a non-trivial univariate polynomial by (Gaussian) elim- 
ination on © if x(-D) < D. (This is because the if -vector space K[Xi\< d has 
dimension D + 1, thus if x(-D) < D, then dim k(Ud) + d\m K {K [Xi]<£>) > 
dim# (if [Xi, . . . , Jf n ]< 2 j), and this implies that U& H K[Xi\< d /=£0}.) In order 
to analyze the running time of the XL-algorithm, it is of greatest importance to 
study the question for which D one can expect this condition to hold (if such a 
D exists at all). We thus define D m in be the minimal D with x(-D) < D (if no 
such D exists, we set O m in = oc). 

The starting point for our analysis of the XL-algorithm is the interpretation 
of the original XL-algorithm via the theory of homogeneous polynomial ideals 
pointed out by Moh ([T3]). This interpretation opens the door for the usage of 
well-established methods from commutative algebra - the keywords are Hilbert 
Theory, Hilbert functions, Hilbert series and Hilbert polynomials. 

A crucial observation is that in order to derive lower bounds on x(-D) (i.e. 
upper bounds on dim k(Ud)) it suffices to study the dimensions of the homoge- 
neous parts of algebras defined by generic systems of homogeneous polynomials. 
(This notion will be made precise in Sect. 0]) For rn < n + 1 , these dimensions 
are known, and this information suffices to prove that for m = n + c, c > 1, 


Djnin > 


(see Proposition 0]) In contrast to this inequality, it 
6.4] that “even for small values of c”, c > 2, one has 


Anin * VU - 


( 4 ) 

suggested in [7]-Sect. 


( 5 ) 


Let us fix the field K and c > 2 and study the asymptotic behavior of the 
running time of the original XL-algorithm for n — > oc (and m = n + c): If (J5J) 
was true, the XL-algorithm in [7] would have a running time (in field operations) 
which is subexponential in n. (This hope was expressed at the end of Sect. 6.1 of 
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[7] as well as at the end of the introduction of (7j.) However by (0), the running 
time of all instances for which U D n K[Xi]< d = {0} for all D < D m in is not 
subexponential in n. 

If K is a finite field and #K and n are not “too small” it seems very reasonable 
to expect: Under all systems m which have a solution in K , the portion of 
systems for which Ud fl K[X i]<& /={0} for some D < D mln is negligible. This 
suggests that for any fixed c > 1 the median of the running times of the original 
XL-algorithm applied to systems of m = n+c quadratic equations in n variables 
over K which have a solution in K is not subexponential in n. The hope stated 
at the end of Sect. 1 of [7] that “the expected running time of this technique is 
... subexponential if m exceeds n by a small number” should be abandoned. 

For c > 3, much more precise lower bounds on D UUI1 then the ones in (0J 
can be obtained if one assumes a certain conjecture which implies what the 
dimensions of homogeneous parts of algebras defined by generic systems of ho- 
mogeneous polynomials should be (see Sect. |5J. This conjecture - which is now 
approximately 20 years old - states that certain linear maps are either injective 
or surjective, that is, they have maximal rank. Because of this, we speak of the 
maximal rank conjecture (MR-conjecture). 


3 A Generalization of the Original and the 
Reduced XL-Algorithm 

The original as well as the reduced XL-algorithm of can easily be general- 
ized to more general than quadratic systems of polynomial equations (see also 
[5]-Sect. 2]). 

For these generalizations, we start off with a system of m polynomial equa- 
tions 

. . . , X n ) = 0, ... ,f m (X 1 ,...,X n )= 0 . (6) 

The generalization of the original XL-algorithm works just as the original XL- 
algorithm stated in the previous section with the difference that for some D G 
N, one applies Gaussian elimination to the linearized system of all polynomial 
equations fe 

f[X H -f j (X 1 ,...,X n ) = 0, (7) 

e = i 

where k + deg (/,■) < D. 

Clearly, the reduced XL-algorithm can be generalized in a similar manner. 
From now on, we refer to these generalizations also as the “original” and the 
“reduced” XL-algorithm. 

Let us fix the following notations. 


As in the previous section, let 

U D ~ { riti X it ■ fj (Xi , . . . , X n ) with k < D — deg(/j))i 


(8) 
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- and 

X (D) := dim k (K[X u . . . ,X„]< D ) - dim K (U D ) . (9) 

Let K = F g . 

- If / € K\X i, . . . ,X n ]< D , we denote by / red the “reduction” of /, i.e. / red 
is the polynomial obtained by maximally reducing all exponents in the 
monomials according to the relations n^=i ~ X? ■ X if = 0. Note 
that (. . .) red is a homomorphism of if -vector spaces and that (t/r>) red < 
(if [Xi , . . . , X„]<£>) red is the space of equations generated in the reduced 
XL-algorithm. 

- In order to analyze the reduced XL-algorithm, we set 

X red (L>) := dim*((if [Xi, . . . , X^)** 1 ) - dim* ((E^)"* 1 ) . (10) 

- Let U D be defined just as U D with respect to the system of m+n polynomials 
fi,...,f m ,Xf-X 1 ,...,X«-X n , and let x(D) be defined as X (D) with 
respect to Ud- 

The proof of the following proposition can be found in Appendix El 
Proposition 1 . We have x red (-D) = x{D) . 

Because of this proposition, the results on the original XL-algorithm can 
easily be carried over to the reduced XL-algorithm. What remains is to derive 
non-trivial lower bounds on x(-D)- 


4 The XL- Algorithm and Hilbert Theory 

In the following discussion, we assume that the reader is familiar with basic 
notions of commutative algebra as can for example be found in the first three 
chapters of Q]. 

As mentioned in Sect. [5] our analysis of the XL-algorithm relies on an in- 
terpretation via homogeneous polynomial ideals. The main idea is to consider 
(for some field K, some n £ N and some D £ N) the homogeneous polynomials 
of degree D in n + 1 variables instead of the polynomials of degree < D in n 
variables. 

Let K be an arbitrary field, n £ N, and let /j , . . . , f n £ K[Xi, . . . ,X n ], 
We use the notations of the previous sections, and additionally we denote by 
If [Xo, . . . , X n ]D the If -vector space of all homogeneous polynomials of degree D. 
More generally, for any positively graded If[X 0 , . . . ,X„]-module M, we denote 
the homogeneous part of degree D of M by M D . 

Let Fj £ K [Xo, . . . , X„] be the homogenization of fj, that is, Fj is the 
unique homogeneous polynomial in If [Xo, . . . , X„] of the same degree as fj with 
Fj(l,X 1 ,...,X n ) = f j (X 1 ,...,X n ). 

Let 

F : If [X x , . . . ,X n ]< D — If [X 0 , . . . , X n ] D 
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be the “degree D homogenization map” , that is, the K - linear map given by 






Then under the isomorphism the A'-vector space Up corresponds to 


( n • Fj(X o, X 1 ,...,X n ) with k = D — deg (Fj)) K , 


where the products are taken over the variables X 0 ,. . X n . This space is nothing 
but the D th homogeneous component of the homogeneous ideal 

I:=(F 1 ,...,F m )<K[X 0 ,...,X n \ , 

denoted Id- We have 

X (D) W dim k{K[X u . . -,X n ]< D ) - dim K (U D ) 

= dim K (K[X 0 , ---, X n ] D ) - dim k(Id) n-n 

= dim K (K[X 0 ,...,X n ] D /I D ) 

= dim K ((K[X 0 ,...,X n ]/I) D ) . 

Let R := K [Xq . . . . , X rt ], Recall the following definitions (see e.g. [TSl-Sect. 

I])- 

Definition 2. Let M = © ieNo M, : be any finitely generated positively graded 
R-module. Then the function 

Xm ■ N 0 — » N 0 , Xm{i) '■= dim K (Mi) 

is called the Hilbert function of M. 

The power series with integer coefficients 

Hm ■-= Y, 

ie No 

is called the Hilbert series of M. 

Note that the above equation ([111) states that 

X(D) = X r/i(D) for all D e N . (12) 

Let us denote by X- the monomial corresponding to the multiindex i 6 
Nq 0, "’"I. The following definition can be found in Pi- 

Definition 3. A form (i.e. a homogeneous polynomial) G = JT <hX 1 £ R of 
degree d is generic if all monomials of degree d in R have coefficients ai in G, 
and these coefficients are algebraically independent over the prime field of K. 

A generic system of forms is a system of generic forms Gj = ]C,; a^X- as 
above (not necessarily of the same degree) such that all are algebraically 
independent over the prime field of K. An ideal I generated by a generic system 
of forms is called generic, and so is the R-algebra R/I. 
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Lemma and Definition 4. The Hilbert series of an ideal generated by a generic 
system G 1 , . . . , G rn of forms of degrees di, ... ,d m depends only on the charac- 
teristic of the field, the number n and the tuple of numbers (di , . . . , d m ) . If the 
characteristic of the field is 0, we speak of the generic Hilbert series of type 
(n + 1; m; d\, . . . , d m ). 

Proof. Let K and L be two fields over the same prime field F, and let 
Gi, . . . , G m e K[X 0 , ...,X n \,G[,..., G' m g L[X o, . . . , X n ] be two generic sys- 
tems of forms such that deg(Gj) = deg(G') for all j. Let Gj = JA of' 1 X\ 
GI = Yfi a'iXk Let k and l respectively be the subfields of K and L generated 
by the coefficients of G :] and Gj over F. Then there exists a (unique) isomor- 
phism between k and l under which of^ corresponds to a'^\ We thus have for 
all D € N 0 

Xiqx 0 ,...x n ]/(Gi,...,G m )(-D) = dimic((iir[Xo, . ..X n ]/(Gi, ..., G m )) D ) = 
dim fc ((fc[X 0 , . ..X n )/{Gx, ..., G m )) D ) = 
dim ,((/[X 0 , • • • X n ]/{G' V ..., G' m )) D ) = 

dim L ((L[Xo, . . •^»]/(Gi, . . . , G' m )) D ) = Xt\x 0 ,...x^y{G’ l ,...,G' m ){D) ■ 

□ 

Together with (fl2ll , the following proposition is crucial for our analysis of the 
XL-algorithm. 

Proposition 2. Let K be any field (of any characteristic), and let Fi, . . . , F rn 6 
R = K[X o, . . . , X„] be forms of degree di, ... ,d m (not necessarily generic). 
Let H g be the generic Hilbert series of type (n + 1; m; d\, . . . . d rn ). Let I := 

{ F \ , . . . , F m ) < K[X o, . . . , X n ]. Then we have the coefficient-wise inequality 

H R/I > Hg . 

This proposition seems to be well-known in commutative algebra (see e.g. 
Sect. 4 of [IS]); for the lack of a suitable reference we include the proof in 
Appendix [B] 

Because of (fl2l) and this proposition the task is now to study generic Hilbert 
series. The following proposition is a well-known statement from commutative 
algebra. 

Proposition 3. Let m < n+1, and let Gi , . . . , G m -i,G m = G be a generic sys- 
tem of forms in R = K[X 0 , . . . , X„], where G has degree d. Let 
J := (Gi, . . . , G m _ i) < R. Then for all D e No the multiplication map 

G- : ( R/J) d (R/J) D+d , F i — >G • F 
is injective, in particular we have a short exact sequence 

0 — ( R/J) d (R/ J) D+d — (. R/(J , G)) D+d — 0 . 

(Here by ( J, G) we denote the ideal of R generated by J and G.) 
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Indeed, this proposition is nothing but a reformulation of the well-known 
statement that a generic system of forms in K[X 0 , . . . , X v ] with at most n + 1 
elements forms a regular sequence (cf. [Tffl-Sect. 4], Page 318). (The fact that a 
generic system of forms is a regular sequence can be seen as follows: By Lemma 
EH in Appendix [Bj it suffices to prove that for all (d \ ..... d n +i) e N" +1 there 
exist some forms Fi, ... . F n+ i e R of degrees di, : d n+ -\ which form a regular 
sequence, and by [121-Theorem 16.1], the forms Xfi 1 ,... , X ^ n+1 do form a regular 
sequence.) 

Note that the Hilbert series of R = K[X 0 , . . . , X n ] is 



(13) 


(see e.g. [161-Sect. 1]). Proposition [3] and (fT3l) imply by induction on m: 

Proposition 4. Let m < n+ 1, and let G \, . . . , G m be a generic system of forms 
of degrees d \, . . . , d m in R. Then the Hilbert series of R/(Gi , . . . , G rn ) is 


UT= i(i - t**) 

(1 -pp+1 


For simplicity we now concentrate until the end of this section on the case of 
quadratic equations. 

Proposition 5. Let m = n + c for some c > 1. Let Fi, ... . F m be quadratic 
forms in R = K[X 0 ,. . . ,X n \. Then the Hilbert series of R/{F \, . . . , F m ) is 
coefficient-wise greater- or- equal 


(l-(c-l)T 2 )(l + Tr +1 


Proof. By Proposition [5] we only have to prove that the generic Hilbert series of 
type (n + 1; m; 2, . . . , 2) is coefficient-wise greater-or-equal (1 — (c — 1)T 2 )(1 + 

Tr+\ 

So let if be a field of characteristic 0, let R = K[X o, ...,X n ], and let 
G \ , . . . , G rn be a generic system of quadratic forms in R. (The assumption 
on the characteristic is not necessary for the following argument.) Let R' := 
R/(Gi , . . . , G n . |_i), and let I ’ be the ideal generated by G n+ 2 , . . . , G m in R! . 
Note that by the above proposition, the Hilbert series of R ’ is (1 + T) n+1 . We 
have R/(G lt ...,G m )& Rf/I 1 , thus 

XR/{Gi,...,G m )(D) = XR’/(G n+ 2,-,G m )(D) = dim k(R' d ) ~ dim k(I'd) ■ 

Now, for D > 2, I' D = J2jL n + 2 ^3 ' R'd- 2 > w l iere by definition Gj ■ R ' D _ 2 is 
the image of R' D _ 2 under the multiplication map Gj- : R ' D _ 2 — » R' D - It follows 
that 


dim K (I' D ) < (to - n - 1) dim K (R' D _ 2 ) 
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All in all, we have 

Xii/(Gi,...,G m )(- D ) > XR'( d ) - (c- 1)xr'(D-2) , 


thus 


%^,.,G m ) > H w - (c- 1)T 2 H r , = (1 - (c- 1)T 2 )(1 + T) n+1 . 


Proposition 6. Let K be any field, let m = n + c with c > 1, let fi , . . . , f m £ 
K[X i, . . . , X n ] be quadratic polynomials, and as in Sect. [H let D m i n be the min- 
imal D with x{D) < D, where x(-D) is defined as above with respect to these 
polynomials. Then 


Sketch of the Proof. Let c > 1, m = n + c, /i, . . . , f m and x(D) be as in the 
proposition. By (IT21) and the above proposition, we have 


ini ^ An- D + 2)(n- D + 3) ( n+l\ 

* (D)£( (Bli )D 


for all D > 2. The proposition follows from the statement that ( ^ ' "* 

(c — 1)) • > D for all D < We only show the slightly weaker state- 

ment that ^ ra ~' P (j 2 2i 7 )p~ P+3 ^ — (c — 1) > 0 for all D < ^T_ +1 . 

Let D < Then D\J c — X + D < n, thus D 2 (c — 1) < (n — D) 2 . This 

implies that (D - l)£>(c - 1) < (n - D + 2)(n - D + 3), i.e. - 

(c — 1) > 0. □ 


Remark 5. For an application of the XL-algorithm to a system with m = n 
quadratic equations, one can easily see with Propositions [2] and H] and (fT31) that 
one always has y(D) > 2”, and for to = n + 1 quadratic equations, one has 
-Dmin > n+ 1. Both these results are consistent with conjectures in [7j. 


5 The Maximal Rank Conjecture 

The maximal rank conjecture (MR- conjecture) which we now state can be thought 
to be a (potential) generalization of Proposition [3] 

Conjecture. Let K be afield of characteristic 0, and let Gi, . . . , G m _i, G m = G 
be a generic system of forms in R = K[X 0 , . . . , X n ], where G has degree d. Let 
J := (Gi, . . . , G m _i) < R. Then for all D £ N 0 the multiplication map 

G- : ( R/J) D — * {R/ J) D+d , F \ — >G ■ F 

has maximal rank , that is it is injective if dim k((R/J)d) < dim k((R/ J)d+<i) 
and it is surjective if dim^ ((R/J)d) > dirri/f ((/?./ J) n+d)- 
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This conjecture - which is also known under the name “Froberg’s Conjecture” 
- can (in an equivalent formulation) be found in [TU]. It is also stated in Sect. 4 
of the informative overview article M- (Note however that the formulations at 
the beginning of Sect. 4 of [TB] are a bit vague.) Interesting facts about this and 
related conjectures can be found in m- 

The conjecture is known to hold if one of the following five conditions is 
satisfied: m < n + 1 (see Proposition |3j , n=l,n = 2, m = n + 2, D = 
minj{deg(Gj)} + 1 (see [TUI-3.2.] and the citations in [TBT-Sect. 4]). 

The conjecture is equivalent to the statement that 

Xr/(j,g){D) = ma x{xr/j(D) - Xr/j( d ~ d) , 0} 

as one can easily see (cf. [161-Sect. 4]). (Here, we set XR/j(i) = 0 for i < 0.) 

Obviously, if Xr/(j,G)(D ) = 0, then Xr/(j,g)(D') = 0 for all D' > D. Using 
this fact, the conjecture can be reformulated via Hilbert series as: 

H R/{RG] = \{l-T d )H R/I \ , (14) 

where for some power series p(T) with integer coefficients, \p(T) denotes the 
power series q(T) = JT q,T'\ where 

q, = pi if pj > 0 for all j < i 

0 if pj < 0 for some j <i . 


Assumption. From now on, we assume that the maximal rank conjecture is 
valid. 


Let A be a field of characteristic 0, let G \, . . . , G rn be a generic system of 
forms in R, and let dj := deg (Gy). Let I := (G 1 , . . . , G m ). Using (THTl) . (Hill and 
Lemma [B] in Appendix ICl we have 


|nr=i(i-^)| 

R/I | (1 -T)«+1 | 


(15) 


Definition 5. (see fTBf i We call the right-hand side of the above equation the 
expected Hilbert series of a generic algebra of type (n + 1; m; d\, , d rn ) . 

Proposition [5] implies: 

Proposition 7. Let K be any field (of any characteristic), and let F\, ... . F m G 
R = K[X 0 , . . . , X n ] be forms of degree d\, . . . . d rn (not necessarily generic). Let 
H e be the corresponding expected Hilbert series. Let I := (iq , . . . , F m ). Then we 
have the coefficient-wise inequality 

H r/i > H e . 

Together with ca, this proposition has the following implication for the 
original XL-algorithm. 
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Theorem 1. Let K be any field, let be non-trivial polynomials in 

K[X i, . . . , X n ] with degrees d,\, ... , d rn . Let D gN, and let x(-D) be defined as in 
W- Then x(-D) is greater- or- equal to the D th term of the expected Hilbert series 
of a generic algebra of type (n + 1; m; d ±, . . . , d m ). 

By Proposition [lj this theorem has the following corollary which can be used 
to analyze the reduced XL-algorithm. 

Corollary 1. With the notations of the theorem, let K = ¥ q , and let x red (D) 
be defined as is (Q2|h Then y red (D) i$ greater- or- equal to the D th term of the ex- 
pected Hilbert series of a generic algebra of type (n+1; m+n: d\, ■ ■ . , d rn . q, . . . , q). 

Remark 6. Let D n>fn be the degree of the expected Hilbert series of a generic 
algebra of type (n + 1; m; 2, . . . , 2). One can use the methods presented in [23- 
Sect. 5] to study asymptotic behaviors of D n , m . A corresponding study is carried 
out in [3]. One obtains D n n+C ~ s for any fixed c > 2 and n — > oo. (More 
precise results for various small c can also be found in [3].j For a fixed a > 1, a 
reformulation of a result in [3] gives D r , iQri ~ (a — \J d 1 — a — |) • n for n — > oo. 
For example, one has D n> 2 n ~ C ■ n with C = | — \/2 ps 0.0858 (which is 
consistent with the “Comparison with 2 n equations over Q” on page 13 of [2]). 
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A On the Connection Between the Original and 
the Reduced XL-Algorithm 

The purpose of this section is to prove Proposition [T] 

As in Proposition [TJ let K = ¥ q . Let 

V D := (f[ X it • {X? - Xi) with k + q < D) K < K[X U ..., X n ]< D . 


Lemma 1. Let U be any K-vector subspace of K[X i, . . . , X n ]< D . Then we have 
a short exact sequence 

0 — ► Ef n yb — ► 17 — ► U red — > 0 . 

Proof. It is obvious that tlfWn is contained in the kernel of (. . ,) red . The converse 
follows from the following lemma. □ 

Lemma 2. Let f £ K[X \, . . . , X n }. Then there exist polynomials p\, . . . ,p n of 
degree < deg(/) — q with 

f = Pi- {Xf-Xx) + ...p n ■ (Xl-X n ) + r d . 
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Proof. By the linearity of (. . . ) red , it suffices to prove the statement for mono- 
mials, and for monomials it is obvious by the very definition of (. . .) red . □ 

Let us use the definitions of Sect. [3] 

We have by Lemma [T] 

{K[X U . . . , W„]< D ) red ~ K[X U . . ,,X n ]< D /V D , 

(u D y ed ~ u D /(u D n v D ) ~ (u D + v D )fv D ~ u D /v d , 

thus 

(K[X U . . .,X n ]< D y ed /(Un) Ied ss (K[Xi , . . . , X n \< D /V D )/{U D /V D ) 

~K[x u ... t x n yv D . 

This implies: 

X Ied (D) = dim k ((K[X u X n \< D y ed /(U D y ed ) 

= dim K {K[X u ...,X n ]< D /U D ) =x(D) . 


B Hilbert Series of Generic and Arbitrary Algebras 

The purpose of this section is to prove Proposition [2] Let us before we come to 
the proof state two lemmata. 

Lemma 3. Let A be a domain with quotient field Q. Let K be a field and let 
ip : A — > K be a homomorphism, and let $ : A[X 0 , . . . , X n \ — ► K[X 0 , . . . , X n \ 
be the canonical extension of ip. Let I < A[X o, . . . ,X„] be a homogeneous ideal 
(that is, an ideal generated by homogeneous polynomials). Then we have the 
coefficient-wise inequality 

H K [x o ,...,x n \/( 0 (i)) > -ffgpco, ...,*„]/(/) • 

Proof. Let D e No- The map p : A — > K induces a canonical map 

(A[X o, ..., X n ]/I) D — > (A[X 0 , . . . , X n ]/I) D ® A K 

(A[JSC 0 , • • • , X n ]/I ® A K) d ~ (K[X o, . . . , X m ]/(0(I))) D . 

This implies that 

XK[x 0 ,...,x n ]/($(i))(D ) 

= dim K ((A[X 0 , . . . , X n ]/I) D ® A K) 

> dimg((A[Xo, . . . , X n ]/I) D ® A Q) by Lemma 0] below 
= dim Q ((Q[X 0 ,...,X n )/(I)) D ) 

= XQ[x 0 ,...,x n \/(i){D) . 


Lemma 4. Let A be a domain with quotient field Q, and let M be a finitely 
generated A-module. Let K be a field and let ip : A — > K be a homomorphism. 
Then 


dim K (M ®aK) >dim.Q(M ® a Q) ■ 
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Proof. Let m be the kernel of ip. Then M 0 a K ~ M m ®A m K and M 0 a Q — 
M m 0A m Q- We can thus assume that A is a local ring with maximal ideal 
m = ker (tp). As the dimension of a vector space is stable under base-change, we 
can further assume that <p is surjective. Now if mi , . . . , m r form modulo m a 
basis of M 0a K over K then by Nakayama’s Lemma ((^-Corollary 4.8]) they 
generate the T-module M, thus they generate M 0 a Q over Q. □ 

Proof of Proposition [H We keep the notations of the proposition. The propo- 
sition follows from Lemma [3] applied to the multivariate polynomial ring A = 
Z[{ofB the ideal I = (G 1; . . . , G m ), where G x ,...,G m with Gj = J2i o^-X* 
and deg(Gy) = dj is a generic system of forms, and the specialization homomor- 
phism <p : A — > K sending to the corresponding coefficient of Fj. (Note 
that the quotient field of A is Q({a^}) which has characteristic 0.) □ 


C A Lemma on Power Series 

The following lemma generalizes [TOl-Lemma 4]. For the convenience of the 
reader, we include a proof. 

Lemma 5. Let p(T ) be a power series with integer coefficients, let d £ N. Then 
|(1 — T d )p(T)\ = |(1 — T d )\p(T)\\ . 

Proof. Note that ((1 — T d )p(T))i = Pi for i < d and ((1 — T d )p(T))i = Pi~ Pi-d 
for i > d. 

Thus the coefficients whose index is < d of both sides agree. Furthermore, if 
Pi <0 for some i < d, then both sides are equal. 

Let us assume that for alH = 0, . . . , d — 1, we have pi > 0. 

If now for all i we have p,; —pi-d > 0, then we also have Pi > 0 for all i as can 
easily be seen by induction on i. In this case, both sides agree with (1 —T d )p(T). 

Assume that this is not the case and let a be the least natural number for 
which p a — Pa-d < 0. 

Then for each i < a, we have p» > 0 again by induction on i. 

There are two cases: Either p a > 0. Then |p(T)| a — \p(T)\ a -d = Pa —p a -d < 0 
by definition of a. Or p a < 0. Then |p(T)| a — \p{T)\ a _ d = —p a -d < 0. 

We conclude that for i < d — 1 , the i-th coefficient of both sides agrees with 
Pi, for d < i < a, the i-th coefficient of both sides agrees with pi — pi- d , and for 
i> a, the i-th coefficient of both sides is 0. □ 

The work described in this paper has been supported in part by the Euro- 
pean Commission through the 1ST Programme under Contract IST-2002-507932 
ECRYPT. 

The information in this document reflects only the author’s views, is provided 
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Abstract. This paper compares the XL algorithm with known Grobner 
basis algorithms. We show that to solve a system of algebraic equations 
via the XL algorithm is equivalent to calculate the reduced Grobner basis 
of the ideal associated with the system. Moreover we show that the XL 
algorithm is also a Grobner basis algorithm which can be represented as 
a redundant variant of a Grobner basis algorithm Fa. Then we compare 
these algorithms on semi-regular sequences, which correspond, in con- 
jecture, to almost all polynomial systems in two cases: over the fields F2 
and F, with q^> n. We show that the size of the matrix constructed by 
XL is large compared to the ones of the F 5 algorithm. Finally, we give 
an experimental study between XL and the Buchberger algorithm on the 
cryptosystem HFE and find that the Buchberger algorithm has a better 
behavior. 

Keywords: Multivariate polynomial equations, Algebraic attacks, Solv- 
ing Systems, Grobner basis, XL algorithm, Semi-regular Sequences. 


1 Introduction 

Algebraic attacks are among the most efficient attacks for public key cryptosys- 
tems, block ciphers and stream ciphers. They try to recover a secret key by 
solving a system of algebraic equations. Algebraic attacks were first applied to 
Matsumoto-Imai Public Key Scheme in [l9] by Jacques Patarin and a similar 
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attack was also applied in [15]. Algebraic attacks were also applied to block 
ciphers in |6], where the complexity for attacking AES and Serpent was evalu- 
ated. Moreover, algebraic attacks were applied to stream cipher in [7], [|], 9 
and improved in |T|. 

As a general method to solve a system of algebraic equations, we know 
Grobner basis algorithms. The fastest of such algorithms previously known are 
the Fi and F 5 algorithms introduced in |fl|] and fllll , respectively. 

The XL algorithm was proposed as an efficient algorithm for algebraic at- 
tacks. It was first introduced in |20j and applied to an attack for HFE which is 
an improved version of Matsumoto-Imai Public Key Scheme. It was improved 
in [5). As stated in |20|| , in cryptographic scheme, a system of algebraic equa- 
tions we are interested in has a unique solution over its defining field. The XL 
algorithm was proposed as a powerful technique to solve such special systems. 
In [20|, it was stated that the XL algorithm does not try to calculate a whole 
Grobner basis and therefore it should be more efficient. 

Recently, by using the algorithms F 4 and _F 5 , 80-bit HFE were first cryptana- 
lyzed in |l4l , whereas the XL algorithm was not applicable to 80-bit HFE. Time 
results with an implementation under Magma are presented on A. Steel’s web 
page (http://magma.maths.usyd.edu.au/users/allan/gb/). As we stated above, 
the F 4 and jFg algorithms are Grobner basis algorithms. Why did algebraic crypt- 
analysis based on these Grobner basis algorithms exceed XL? We give an answer 
for this question in this article. 

In this paper we clarify a relation between the XL algorithm and Grobner ba- 
sis algorithms. Moreover, we study the XL algorithm on semi-regular sequences, 
which correspond, according to a conjecture in a report [3], to almost all overde- 
fined polynomial systems, and on the cryptosystem HFE. 

More precisely, we show the following: 

1. The XL algorithm does not introduce explicitly a monomial ordering. But 
we have proved that if the XL algorithm terminates, it will also terminate 
with a lexicographic ordering. 

2. To solve a system of algebraic equations whose solution in a given finite field 
is unique amounts to nothing but to calculate the reduced Grobner basis for 
the ideal associated with that system. 

3. By 2, the XL algorithm is actually a Grobner basis algorithm. Moreover it 
is essentially the same as the one treated in |jl7] and can be viewed as a 
redundant variant of a Grobner basis algorithm F4. 

4. We study the XL algorithm on semi-regular sequences. 

On F2, that the degree D of the parameter needed for the XL algorithm is 
almost the same as the degree of the polynomials in the matrix constructed 
by the F 5 algorithm. But the complexity of these two algorithms is specified 
by the size of the matrix: for example, for a quadratic multivariate polynomi- 
als with n = 128 and m = 130, both algorithms reached the same degree 17 
and the matrices generated by the XL algorithm will have about 170 X 10 20 
rows and 6 X 10 20 columns compared to squared matrices with only 6 X 10 20 
rows and columns for the F 5 algorithm. 
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On the field F g , with q very large compared to n, we show the XL algo- 
rithm terminates for a degree higher than Grobner basis algorithms with a 
DRL order. Then it is obvious that XL matrices are huge compared to F 5 
matrices. 

5. We complete this study on generic systems with a comparison of the XL 
algorithm and the Buchberger algorithm for a cryptosystem HFE. For this 
cryptosystem, a Grobner basis algorithm finds a structure in the multivariate 
systems and never exceeds a low degree, whereas, for the XL algorithm, the 
degree seems to still increase with the number of variables n. 

The XL algorithm was proposed to be a more efficient algorithm to solve a 
system of equations under a special condition without trying to calculate a whole 
Grobner basis. But our results imply that the XL algorithm is not so efficient as 
it was expected to be. 

In Section[2] we recall the description of the XL algorithm. In Section 3, 
we give an overview of the theory of Grobner bases. In Section 4, we clarify a 
relation between the XL algorithm and the F,i algorithm. In Section 5, we study 
the behavior of the XL algorithm on semi-regular sequences. In Section 6, we 
give experimental results on HFE systems and in Section 7, we conclude this 
report. 


2 The Basic Principle of XL 

The XL algorithm is given as an algorithm which solves systems of quadratic 
equations having a solution in k n for a finite field k = ¥ q . Let A be a system 
of multivariate equations f 3 = 0, (1 < j < m) for fj e fc[x] := k[x \ ..... x r ,]. 
We denote the ideal generated by all fj in A by X 4 . Then, XL is described as 
follows [20] . 

Algorithm 1 (The XL Algorithm). For a positive integer D, execute the 
following steps: 

1. Multiply: Generate all the products IIj = i x i, * fi^^A with r < D — 2 and 
total degree < D. 

2. Linearize: Consider each monomial in the Xj of degree < D as a new variable 
and perform the Gaussian elimination on the equations obtained in Step 1 . 
The ordering on the monomials must be such that all the terms containing 
one variable (say x \ ) are eliminated last. 

3. Solve: Assume that step 2 yields at least one univariate equation in the 
powers of x\. Solve this equation over the finite fields (e.g., with Berlekamp’s 
algorithm). 

4. Repeat: Simplify the equations and repeat the process to find the values of 
the other variables. 

In the original definition of the XL algorithm in [20] , only quadratic equations 
are treated. If we change the condition ’’with r < D — 2 and total degree < D” 
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in Step 1 to ’’with r < D — deg(/j)”, we can apply XL to a system of equations 
including a non-quadratic equation. Note that this change does not contradict 
the original XL setting when a system of equations consists of quadratic equa- 
tions. So hereafter, we use this generalized version in order to work in general 
case. 

Remark 1. We can replace Step 1 of the XL algorithm by considering f* the 
homogenization of /,: f* = Z d f( x f , . . . , ) £ fc[x, Z] and products mf* with m 

a monomial with degree D— deg(/*). All the computation is exactly the same. So 
the behavior of XL is the same on the homogenization of the system A as on A. 
We will use this remark on section |5j and for more properties of homogenization, 
we refer to |I]. 

3 Grobner Basis and Some Algorithms 

3.1 Basic Notation and Definitions 

Let fc[x] = k[x i, . . . , x n ] be a polynomial ring with variables X\,. . . . x n over a 
field k. For a monomial x“ = x/j 1 ■ ■ ■ ai“ n , |a| := i a i ' s called the total degree 
of this monomial. In the following, the set of all monomials in variables Xi , . . . , x n 
is denoted by M(x i, • • • , x n ), or simply by M. In the theory of Grobner bases, 
we need to consider a monomial ordering (cf. [To]). One of such ordering is the 
degree reverse lexicographical order (DRL) defined as follows: 

Definition 1 (cf. [14]). For a = (ai, ..., a n ), f3 = (/?i, ..., /3 n ) £ Z> 0 , We say 
x a >drl if |a| = Y^i=\ a i > \P\ = Z)"=i or M = \0\ an d the right-most 
nonzero entry of the vector a — (3 gZ" is negative. 

There are many monomial orderings. We choose one of such orderings on T 
and write it as <. 

A nonzero polynomial / in fc[x] is written as / = Yl a c a x “, c a /= 0. We use 
the following notations: 

T(f) = {c( aii ... iC>ra )a;“ 1 • • • a;“ n | C( aii ... ]0 , n ) /=]0: the set of terms of / 

M(/) = {a;® 1 • • • | C( aij ... )Qn ) / =)0: the set of monomials of / 

We denote the total degree, the leading term, the leading coefficient and the 
leading term with respect to <, by deg(/), LM(/), LC(/) and LT(/) respectively. 
(For each definition, see jlO] A 

The ideal in fc[x] generated by a subset F is denoted by (F). We also denote 
by (Ji, . . . , I n ) the minimal ideal containing ideals 1%, . . . , I n . 

Under the above notation, a Grobner basis is defined as follows. 

Definition 2. Let M be the set of all monomial of fc[x] with a fixed ordering. 

A finite subset G = {pi, . . . , g rn } of an ideal I is called a Grobner basis if 

(LT( 5l ),...,LT( flm )) = (LT(T)). 

For a given ideal 2, its Grobner basis is not unique. But the reduced Grobner 
basis, which is defined as follows, is uniquely determined. 
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Definition 3. A Grobner basis G = {/i, . . . f m } of an ideal X is called reduced 
Grobner basis if for all i, LC(/j) = 1 and any monomial of fi is not divisible by 
any element o/LM(G\{/j}). 


3.2 The Buchberger Algorithm 

An algorithm which calculates a Grobner basis is called a Grobner basis algo- 
rithm. The Buchberger algorithm is one of them. 

Definition 4. Let f. g G fc[x] be nonzero polynomials. The S-polynomial of f 
and g is the combination 


S(f,g) := LC (g) 


lcm(LM(/),LM(p)) 

LMfJ) / LC(/) 


lcm(LM(/),LM( ff )) 

L M(g) 9 ' 


For a finite set G of polynomials in fc[x] and a polynomial f £ k [x] , we denote 
by f G , a remainder of / on division by G. (For the definition of division by a 
finite set of polynomials, see [0 for example.) 

Theorem 1. A basis G = {gi, . . . g rn } of an ideal X in k [x] is a Grobner basis 
if and only if for all pairs i /j, S(gi,gj ) = 0. 

As a result of Theorem 1, we have the The Buchberger algorithm: 


Algorithm 2 (The Buchberger Algorithm). 

Input: an ordered set F = (/i, . . . , f m ) in k [x] 

Output: a Grobner basis G = { g\ , . . . , g s } for I = (/i, . . . , f m ) with F c G 

G := F 

Repeat 

H := G 

For each pair (p,q), p /=? in H, 

If S := S(p,q) H /=0, The£? := G U {5} 

Until H=G 

We remark that the reduced Grobner basis is calculated in a finite number 
of steps from a Grobner basis. 


3.3 Some Other Algorithms 

D. Lazard in the articles [0 describes a relationship between the method of the 
computation of Grobner bases and the one based on Gaussian Eliminations on 
matrix for the system A. Moreover there are some other Grobner basis algorithms 
based on Gaussian elimination: F± [11], FGLM |l3] and X 5 [12]l . We explain now 
the relationship between polynomials and matrices. 

For a system A of equations fj= 0 (j 1 , 2 ,..., m), let us consider a finite 
list G = (gi, . . . , g m ) of elements of the ideal generated by fj, the ordered set 
Mq = [f] , . . . , t[] of monomials of all g t with respect to a fixed order <. A matrix 
A whose (i, j)-entry is given as the coefficient of tj in g t is called the coefficient 
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matrix of G. Note that *G = A ‘Mg where *G and ‘Mg mean the transpose of 
each. Let A be the row echelon form of A obtained by using elementary row 
operations in a standard linear algebra 1 . Then we call G given by *G := A Me 
the row echelon basis of G. When we take the reduced row echelon form of G, 
we say G the reduced row echelon basis of G (In [11] , this is called the row 
echelon basis). Calculation of the reduced row echelon basis is an essential part 
of F 4 . 


4 Relation Between XL and Grobner Basis Algorithms 

4.1 The Choice of a Monomial Ordering 

To compare the XL algorithm with Grobner basis algorithms, we need to give 
an explicit monomial ordering for XL. As the XL algorithm does not give an 
explicit monomial ordering, we need to introduce the following lemma : 

Lemma 1 . Let A be a system of m multivariate equations with n variables. 

XL terminates for a degree D XL terminates for a degree D 
with the Lexicographic ordering 

Proof. Let be M (respect. AT) the coefficient matrix of the list {(Il*=i 
with k < D — deg(fi) for XL (respect, with the Lexicographic ordering). So we 
can write M = (AD) and M' = (A'\B r ) such that B (respect. B') corresponds 
to the columns for the univariate monomials. Moreover M ' , A' and B' are only 
column permutations of M, A and B. 

If XL terminates for a degree D, it means that rank(M) > rank(A). Then 
rank (AT) > rank(A') and then XL will find an univariate polynomial with the 
lexicographic ordering. □ 

4.2 Pre-assumption of the XL Algorithm 

Let k = F q be a finite field with q elements and let A be a system of multivariate 
equations fj = 0 (1 < j < m) where fj € k[x\. . . . , x n }. As stated implicitly in 
the introduction of (20), XL was proposed to be an efficient algorithm to solve a 
system of multivariate equations satisfying the following condition. 

Condition 1 . The system A has only one solution (aq, . . . , x n ) = (ax, . . . , a n ) 
in k n . (i.e. A has a solution (ax, ... , a n ) in k n and no other solution in k n .) 

Note that the system A under Condition 1 can have another solution in K n 
for some extension field K(/ =k) of k. To determine the solution in k n , we need 
extra equations x* — = 0 (i = 1, . . . , n). Thus the ideal we have to consider is 

generated by fj (j = 1, . . . , m) and x ? — Xi (i = 1, ... . n). We denote this ideal 
by I 4 . Then we have the following important theorem. 


1 This procedure is so-called the Gaussian elimination. 


344 G. Ars et al. 


Theorem 2. Let A be a system of multivariate equations fj = 0, j = 1,2, ... . rn 
in k[xi , . . . , x n ] with k = F ? . Let ! a be the ideal (fi, . . . , fm,x\—x \, . . . , xf—x n ). 
Then a solution (xi , . . . , x n ) = (ai, . . . , a n ) £ k n of A is unique in k n if and 
only if 1 a = {xi—ai ,x n — a n ). 

Proof. If (x\, . . . ,x n ) = (a-i , . . . , a n ) is a unique solution in k n of A, 1a C 
{x\ — ai, ... ,x n — a n ) and (oi, . . . , a n ) is a unique solution in k n of a system 
which consists of fj =0 (j = 1, . . . , m) and a;f — Xi = 0 (i = 1, . . . , n) for an 
algebraic closure k of k because x\ — £,; = (] has solutions only in k. Then from 
Hilbert’s Nullstellensatz (cf. [10]), for each i = 1, . .. ,n, there exists a positive 
integer ti such that (aq — af)^ £ 1 a- Since Xj — a^ = gcd(a 'f—Xj, (xj — af)^) £ 1 a, 
we have 1a = (si — a,\. ... . x n — a n ). For the converse, it is obvious. □ 

By this theorem, Condition 1 is equivalent to the following condition. 

Condition 2. The reduced Grobner basis with respect to DRL of the ideal 
1 A = (fi, ■ ■ ■ ,fm,x\ — x\, . . . ,xf — x n ) is {x\ — on, . . . ,x n — a n }. 

Thus the problem to solve A defined over k = ¥ q under the Condition 1 
coincides with the problem to calculate the reduced Grobner basis of the ideal 
generated by equations in A and field equations x\—Xi = 0 under the Condition 
2, which is not a new problem. In particular, if the XL algorithm can solve 
a system A of algebraic equations over ¥ q under the Condition 1, it actually 
computes the reduced Grobner basis of the ideal 1a- 


4.3 Relation Between XL and the F4 Algorithm 

We use the same notation as in fUJ- Here we show the XL algorithm gives 
a Grobner basis algorithm which can be viewed as a redundant variant of the 
F4 algorithm. (For the description of the original F 4 , see 00 To give such a 
description, we need the following definition. 

Definition 5. (1) A critical pair of two polynomials (fi, fj) is an element of 
M 2 x fc[x] x M X fc[x], Pair(fi,fj) := (lcmij,U, fi,tj, fj) such that 


lcm(Pair(fi,fj )) = lcm i:j = LM («*/,) = LM (tjfj) = Icm(LM(/ i ),LM(/ i )). 

(2) For a critical pair pij = Pair(fi, fj), deg (lemij) is called the degree of pij 
and denoted by deg (pij). Let P be a list of critical pairs. Forp = Pair(f,g) £ P 
and d e N, we define two functions XLLeft(p, d) = {(t, /) |t £ M, deg (t* f) < d}, 
and XLRight(p,d) = {(t,g)\t £ M,deg(t* g) < d}. We write XLLeft(P,d) = 
[j peP XLLeft(p, d) and XLRight(P, d) = (j peP XLRight(p, d). 

For a list of critical pairs P and a positive integer d £ N, we set 

Sel(P, d) := {p £ P | deg(Zcm(p)) < d}. 

Now we give an FVlike description of the XL algorithm. 
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Algorithm 3 (The XL Algorithm). 

T , f F : a finite subset of fc[xl 
Inpul: {s e l: fixed as abcrn. 

Output: a finite subset of fc[x]. 

G := F, F+ := F and d := 0 
P := {Pair(f,g)\f,g £ G with / / =g} 
While P /=4> Do 
d := d + 1 

L (i := XLLeft(P, d) U XLRight(P, d) 
P d := Sel(P , d) 

P:=P\Pd 

P/ := Reduction(Pd) 

For h £ P^ Do 

P:=Fu{Pair(fc,ff)| 5 £G} 

G := GU {/i} 

Return G 


Reduction 

Input: a finite subset L of M x fc[x] 

Output: a finite subset of fc[x] (possibly an empty set). 
F := Symbolic Preprocessing^) 

F := Reduction to Row Echelon Basis of F w.r.t. < 
F+ := {/ £ P|LM(/) / <LM(F)} 

Return F+ 

Symbolic Preprocessing 

Input: a finite subset L of M x fc[x] 

Output: a finite subset of fc[x] 

F:={t*f\(t,f)€L} 

Return F 


Remark 2. In the original description of XL, it seems that the bound D is taken 
globally at once. However, to implement XL, there seems to be the following 
four ways to realize the process determining the optimal value of D. Let A be a 
system of equations you want to solve. Then each way is described as follows. 

1. Begin with D = 1. Do XL described as in Definition 1 for A. If you cannot 
obtain the solution, set D := D + 1 and do XL again for A with the new D. 

2. Begin with D = 1. Iterate ’Multiply’ and ’Linearize’ described as in Def- 
inition 1 for A by adding new equations obtained by ’Linearize’ to A. If 
you cannot solve the resulting system, then return to the original A, set 
D := D + 1 and iterate the same procedure as for D = 1. Repeat until you 
obtain the solution. 

3. Begin with D = 1. Do XL described as in Definition 1 for A. If you cannot 
obtain the solution, then set D := D + 1, replace A by the resulting system 
obtained by ’Linearize’ in the previous XL and do XL again for the new A 
and D. Repeat until you obtain the solution. 
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4. Begin with D = 1. Iterate ’Multiply’ and ’Linearize’ described as in Defini- 
tion 1 for A by adding new equations obtained by ’Linearize’ to A. If you 
cannot solve the resulting system A! , then replace A by A' , set D := D + 1 
and iterate the same procedure as for D = 1. Repeat until you obtain the 
solution. 

The first two processes are slightly different from the others. The degree 
reached for the third and the fourth ones can be lower than the degree of the 
others. The Gaussian elimination of polynomials with degree D can give poly- 
nomials with lower or equal to D — 1. For example, let us consider the sys- 
tem x\ + a ?3 = 0, x\x -2 — x-i = 0, £3 + x\ = 0. For D = 3, the polynomial 
X 3 X 1 — X 3 = (xi — l)(a:§ + X 3 ) — x-AxiX 2 — x- 2 ) appear in resulting system ob- 
tained by ’Linearize’, and then for D = 4, the third and fourth methods find the 
univariate polynomial x\ — x\ = (x\ — l)(a?§ + x\) — x\(x3X\ — X3). Whereas, 
the two first methods need a degree D = 5 to find this polynomial because 
x\ — X\ = (Xi - 1)(:E§ + X\) — (x%X\ — $§)(l£§ + X3) + X%X-2(x\X-2 — £2). 

In the above description of XL, we take the third one. You may take one of 
the other three realizations but the rest of our result holds for all of them. We 
should remark that XL taking D as in the first one is essentially the same as 
the Grobner basis algorithm treated in fll7l . 

In the above description of the XL algorithm, we keep some redundancy in the 
description to show the similarity to the F 4 algorithm. Note that in algebraic 
attacks using XL, the input F should be a set of polynomials which comes 
from all equations in a given system of equations A whose solution in k n is 
unique and all field equations x\ — x^ = 0 for all variables x t . ’Multiply’ in 
XL corresponds to the calculation of L,i and ’’Symbolic Preprocessing”. And 
’linearize’ corresponds to ’’Reduction”. Note that, XL in the above description 
can be viewed as a redundant variant of F 4 . This is because XLLeft and XLRight 
collect more polynomials and therefore the set of polynomials constructed in 
’’Symbolic Preprocessing” is much larger than the one in F 4 . In fact, XL collects 
all the products n j=i x h * /< with r < D — deg(/j) , whereas F 4 collects only 
polynomials needed in the Gaussian elimination. 

The above description enables us to prove the following theorem. 

Theorem 3. Let F be a finite set of polynomials in k [x] . Then Algorithm 3 
computes a Grobner basis G for the ideal (F) in A;[x] such that F C G. 

Proof. Let d be a positive integer and G ( j the set G obtained for that d in the 
while-loop. If F£ / = 0 , then deg h < d for any h £ F # and hence h £ Lj+i in the 
next loop. Then it is obvious that h /*&!• Since any g £ Gj - 1 of deg g < d is 
contained in L d , h / G,i-\ for any h £ and hence we have G d - 1 C G d when 

Ft M- 

First, we show that Algorithm 3 terminates in a finite number of steps. Sup- 
pose that Algorithm 3 does not terminate. Then there is an infinite sequence 
(di) of positive integers such that di < dj+i and F d . / =0 for all i. From the 
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above observation, we have an infinite ascending chain G,i t C G r j i+1 C • • • . But 
it contradicts to the fact that the ring fc[x] is noetherian. 

Now we show the output G of Algorithm 3 is actually a Grobner basis of (F). 
Since G = (J d>0 F(f and F(f c (F), we have fcGc (F). The remaining task 
is to show S(f,g — 0 for all / / =g in G. Put d := deg (Pair(f,g)). Then the 
S'-polynomial S(f,g ) is contained in Lj and hence S(f,g ) d = 0. In particular, 
we obtain S(f, g) = 0. Thus, by Theorem 1, the output G is actually a Grobner 
basis of (F). □ 


5 Semi-regular Sequences 

In this section, we try to give a bound on the matrix size of the XL algorithm 
compared to the matrix size of the F§ algorithm for most polynomial systems. 

5.1 Presentation of Semi-regular Sequences 

In the report [3] , the notion of semi-regular sequences was presented for overde- 
fined systems over the finite field F 2 and for affine systems. We have to distin- 
guish two important cases for finite fields, F 2 and F g . In the field F 2 , we have 
a criterion deduced from the Frobenius application. If we are interested in a 
system A on a field F g , with q n, i.e. q is very high compared to n, then the 
trivial relation issued from the Frobenius application will not be reached during 
computation and all the computation done is similar to computation on Q. 

Definition 6. 

Homogeneous Semi-regular Sequence: Let fi, ■ ■ ■ , f m be a sequence of m 
homogeneous polynomials (i.e. for all monomial t of fi, deg(t) = deg(/j) in 
F^ := F 2 [xi, . . . , x n \/{x \, . . . , x\) or Q[xi, . . . ,x n \), and 1 = (fi , . . . , f m ) an 
ideal of F^ or Q[xi, . . . , x n ) . 

— The degree of regularity of I is the minimal degree d such that {LT(f) \ f 
£ 1, deg(/) = d} is exactly the set of monomials of degree d in denoted 
by D reg (T). 

— / 1 , • • • , fm ' LS a homogeneous semi regular sequence on F 2 if T / =F f ( and 
for i e {1, . . . , to}, if gif i = 0 in Fn/{fi, ■■■, fi- 1 } and deg {gift) < D reg (l) 
then gi = 0 in F r J{fi. ..., fc-iji). 

— / 1 , . . . , f m is a homogeneous semi regular sequence on Q if 1 /=Q[xi, . . . , 
x n ] and for i £ ( 1 , . . . , to}, if gifi = 0 in Q[xi, . . . ,x n ]/(/i, . . . , fi-i) and 
deg {gji) < D reg (I) then g { = 0 m Q[xi, . . . , x n ]/(f u . . . , /*_ 1 }. 

Affine Semi-regular Sequence: Let / 1 , . . . , f m be a sequence of to polynomi- 
als, and 1 = (/ 1 , . . . , f m ) an ideal of F 2 [xi, . . . , x„\/{x\ — x\, . . . — x n ) or 

Q[xi, . . . , Xrf[. Let ff the homogeneous part of the largest degree of fi. 
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— /i, . . . , f m is a semi regular sequence if f\, - ■■ ,fm is a homogeneous semi- 
regular sequence. 

— the degree of regularity of I is the degree of regularity of (fi , . . . , f^f), de- 
noted by D reg . 

With this sequence of polynomials, the matrix generated by the F 5 algorithm 
has a full rank for the degree d < D reg . Moreover, all polynomials computed by 
F 5 have a degree lower or equal to D reg . 

This means that, for semi-regular sequences, the number of rows H mjn (d) 
of the matrix in the homogeneous case, for d < D reg , is known, and is given 
by a recurrence formula H m<n (d) = H m _i. n (d) + #{rn^ monomial of degree d — 
dm} — H rn n (d — d rn ) with initial conditions H m , n (d ) = 0 if m < 0 or d < 
min(deg(fk ) | k < m}. Then the number of rows of a matrix for the affine case 
IS Y?d'=\ H ™A d ')- 

The degree D reg corresponds to the degree d when we will have more rows 
than columns for the homogeneous part of the largest degree. It is the minimal 
degree such that H mtTl (d) > if {me. monomial of degree d}. If we consider the 
series f{y) = Y^d>o^rn,n{d) — #{me monomial of degree d})y d , the degree D reg 
is given when the coefficient of this series is negative, the expression of / for 
quadratic equations is: 

( 1 ^ 2 )m for F 2 ^(l~-v) n f° r witl1 q ^ n - 

Moreover, in the article [3], the authors have made a conjecture verified on 
many computer experiments: 

Conjecture 1. almost all polynomial systems are semi-regular sequences. 

As the XL algorithm computes for an homogeneous system, we work on 
semi-regular sequences such that the homogenization of the sequences is still 
semi-regular. With these hypotheses, the conjecture is still true. 

If we want to find an univariate polynomial for the original description of 
XL, we need to have a number of rows higher than the number of monomials 
with degree D minus the number of univariate monomials in X\ (i.e., X\ and 1 
for F 2 and for F g ). 

This means that the degree D of the XL algorithm is given when the co- 
efficient of this series is negative, the expression of / for quadratic equations 


(I_y)(i+y2) m - for F 2 (i-y)*+ l - (l - y y for with 9 > n - 

5.2 On the Field F 2 

Figure 1(a) presents a comparison of the degree reached between the XL algo- 
rithm and Grobner basis computation for a variation of the number of variables 
n and Figure 1(b) for a variation of the number of equations to. 
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Fig. 1. Behavior of the XL algorithm and the F& algorithm on F2 


With these figures, we do not have a noticeable difference between the degree 
reached by the two algorithms. So we can say that for random systems, the 
methods of XL and Grobner basis are almost the same. 

For the complexity point of view, if N D is the size of the matrix constructed, 
then the whole complexity is the cost of linear algebra on this matrix, which is 
N]j where w < 3 is the coefficient of linear algebra. The XL algorithm creates 
matrices with YaLi '$2k=o' 3g ^ (!■) rows aiic l Yk = 0 (fc) columns, whereas F 5 
creates square matrices with Yk=o G) columns. 

So the number of columns for F 5 algorithm matrices is lower or equal to the 
one for XL algorithm matrices whereas the number of rows of the matrices con- 
structed is very different, Figure 2 presents the number of rows of each matrices 
with a logarithm scale. As we can see, the difference between the two curves 
gives us a multiplicative constant. 

5.3 On the Field F q , with q Large 

Figure 3(a) presents a comparison of the degree reached between the XL algo- 
rithm and Grobner basis computation for a variation of the number of variables 
n with m = n + 2 and Figure 3(b) for a variation of the number of equations 
m. First we can see that for random polynomials we have always computed a 



Fig. 2. Matrices of the XL algorithm and F$ algorithm 


F2 
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Grobner basis before finding the univariate polynomial for a degree D. More- 
over, we can see the behavior of the degree of the XL algorithm does not seem 
to follow the formula JT as it was said in (6]. 

As the complexity is N%, where No is the size of the matrix constructed and 
w the coefficient of linear algebra and the XL algorithm has a higher degree D 
than the F 5 algorithm, the difference of the size of constructed matrices is very 
important. For example, for quadratic multivariate polynomials with n = 128 
and m = 130, the XL algorithm reached a degree 66 whereas the F$ algorithm 
reached a degree 61. So the matrices generated by the XL algorithm will have 
about 94317 x 10 49 rows and 6332 x 10 49 columns compared to squared matrices 
with only 8.4 x 10 49 rows and columns for the F 5 algorithm. 

For the case m = n, the number of solutions with multiplicity of a random 
system with quadratic equations is HKLi deg(/ 7 ;) = 2 n , which is the Bezout 
bound. So the univariate polynomial has this degree and XL will terminate for 
this degree. Whereas, the computation of the Grobner basis will not exceed 
1 + Y^=\ (deg (/j) — 1) = n + 1 for any ordering. This computation is done with a 
DRL ordering and then we use the FGLM algorithm [l3| [lO] to find the wanted 
ordering. 

All this study is still true if D < q and not only for q n. 


6 Example on HFE Systems 

In cryptography, the systems studied seem to be random but have a structure 
behind them. So we need to make experimental tests on cryptosystems to have 
an idea of the efficiency of both algorithms. 

Hidden Field Equations (HFE) is an asymmetric cryptosystem. It does not 
use the number theory but it is based on multivariate polynomials over a finite 
field (cf fl8]). The idea of HFE is to take a secret univariate polynomial (the 
private key) on an extension of the finite field, then to express this polynomial 
on the finite field. We thus obtain an algebraic system (the public key). This 
system is composed with polynomials of degree 2. 
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Fig. 4. Comparison between XL and Grobner algorithms on HFE 


We have implemented the XL algorithm in Magma to test on the examples. 
Moreover as the XL algorithm has a better behavior for m > n, we have fixed 
some variables to be in the case m = n + 2. We studied on both cases presented 
in section 5, for the field F 2 , we use secret polynomials with degree 17 and with 
degree 24 for the field F 16 . 

With Figure 4(a), we see that the XL algorithm’s maximal degree increases 
whereas for Grobner basis computation, the degree of resolution does not change 
and does not exceed 3. In fact, the XL algorithm seems to follow Figure 1(a). So 
XL does not seem to find a difference between a random system and the HFE 
cryptosystem contrary to Grobner basis computation. 

Figure 4(b) confirms that the Buchberger algorithm is still better than the 
XL algorithm on a bigger field for a number of elements higher than 6. 



(afonl (b)onl ' 16 


Fig. 5. Time comparison between XL and Grobner algorithms on HFE 

We present then time computation on figure 5. For the XL algorithm, the 
main part of computation is done in the Gaussian elimination and not in the 
other part of the algorithm. As we can see, the Buchberger algorithm has a 
better behavior than the XL algorithm. 
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7 Conclusion 

In this paper, we compared the XL algorithm with Grobner basis algorithms. 
First, we showed that to solve a system of algebraic equations treated in XL is 
equivalent to calculate the reduced Grobner basis of the ideal associated with 
the system. Moreover we showed that the XL algorithm is also a Grobner basis 
algorithm which can be represented as a redundant variant of a Grobner basis 
algorithm F 4 . Then we compared these algorithms on semi-regular sequences in 
two cases: in the fields F 2 and ¥ q with q^> n. We showed that the size of the 
matrix constructed by XL is huge compared to the ones of F 5 algorithm. We 
gave an experimental study between XL and Buchberger algorithms on the cryp- 
tosystem HFE and found that the Buchberger algorithm had a better behavior. 
Our results imply that the XL algorithm is not so efficient as it was expected. 
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Abstract. We introduce a new computational problem related to the 
interpolation of group homomorphisms which generalizes many famous 
cryptographic problems including discrete logarithm, Diffie-Hellman, and 
RSA. As an application, we propose a generic undeniable signature 
scheme which generalizes the MOVA schemes. Our scheme is generic in 
the sense that we transform a private group homomorphism from public 
groups G to H (the order of H being public) into an undeniable signature 
scheme. It is provably secure in the random oracle model provided that 
the interpolation problem is hard and it offers the advantage of mak- 
ing the signature size arbitrarily short (depending on a security level). 
We (im)prove some security results from MOVA. We also propose a new 
example with complexity similar to RSA and with 3-byte signatures. 


1 Introduction 

An undeniable signature scheme is similar to a classical digital signature except 
that the recipient of a message cannot verify its validity alone: he needs to 
interact with the signer in order to be convinced of the validity of the signature. 
This opposes to the so called universal verifiability of classical digital signatures 
where anybody knowing the signer’s public key is able to verify the signature at 
any time. In some applications such as signing a contract, it is desirable to keep 
the signer’s privacy by limiting the ability to verify this signature. However, an 
undeniable signature does not abandon the non-repudiation property. Indeed, 
in case of a dispute, the signer could be compelled by an authority to prove 
the invalidity of a signature, otherwise this would be considered as an attempt 
of denying a valid signature. An undeniable signature scheme is composed of a 
signature generation algorithm, a confirmation protocol to prove the validity of 
a signature, and a denial protocol to prove the invalidity of an invalid signature. 

Since the invention of the first undeniable signature scheme proposed by 
Chaum and van Antwerpen [5] , a certain amount of work has been dedicated to 
its development and different improvements [51 [71 [51 [III [T^] . Until the proposition 


* Supported in part by a grant of the Swiss National Science Foundation, 200021- 
101453/1. 

** Supported in part by the National Competence Center in Research on Mobile In- 
formation and Communication Systems (NCCR-MICS), a center supported by the 
Swiss National Science Foundation under grant number 5005-67322. 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
© Springer- Verlag Berlin Heidelberg 2004 


), pp. 354-13711 2004. 


Generic Homomorphic Undeniable Signatures 355 


of an undeniable signature scheme based on RSA by Gennaro et al. [15], all 
previous undeniable signatures were based on the discrete logarithm problem. 
More recently, three undeniable signatures based on different problems have been 
proposed. The first one is based on pairings [TS], the second one is based on a 
quadratic field @], and the third one (MOVA) is based on characters [T§] . 

In traditional digital signature schemes, the security collapses when the sig- 
nature is too short because of universal verifiability: an attacker can try to guess 
a signature until it is valid in order to forge it. One advantage of undeniable 
signatures is that the security smoothly decreases with the signature length. As 
an example, we can think of 20-bit signatures which cannot be forged but with 
a probability of success of 2 -20 . The forger can increase it in an on-line attack, 
but this can easily be detected and thwarted. So, undeniable signatures could in 
principle be arbitrarily small e.g. as small as a MAC, although no such signatures 
were proposed so far except MOVA signatures. 

In this paper, we provide a new computational problem called Group Homo- 
morphism Interpolation (GHI) problem whose solution consists in finding the 
image of a given point under an homomorphism which interpolates some given 
points. This generalizes and improves the MOVA scheme based on characters. 
Section [U provides some theoretical results about the GHI problem. Section |3] 
contains several interactive proof protocols and some related security results that 
will be used for our undeniable signature from Section HJ Section^ is devoted to 
a new example and further discussions. Finally, Section |6] concludes. 


2 The Group Homomorphism Interpolation Problem 

2.1 Problem Definitions 

Given two Abelian groups G, H, and S := { (rci , t/i) , . . ., (x s ,y s )} C G X H, we 
say that the set of points S interpolates in a group homomorphism if there exists 
a group homomorphism / : G — » H such that f(xi ) = j/j for i = 1, . . . , s. We 
say that a set of points B C G x H interpolates in a group homomorphism with 
another set of points AC GxH if AUB interpolates in a group homomorphism. 
We state here the Group Homomorphism Interpolation problem (GHI problem) 
and its decisional problem (GHID problem). 

S'- GHI Problem (Group Homomorphism Interpolation Problem) 
Parameters: two Abelian groups G and H, a set of s points S C GxH. 
Input: x € G. 

Problem: find y £ H such that (x, y) interpolates with S' in a group 
homomorphism . 

S-GHID Problem (GHI Decisional Problem) 

Parameters: two Abelian groups G and H , a set of s points S C GxH. 
Input: a point ( x,y ) £ G X H. 

Problem: does ( x , y) interpolate with S in a group homomorphism? 
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We also consider the following problems. 

rf-MGGD Problem (Modular Group Generation Decisional Problem) 
Parameters: an Abelian group G, an integer d. 

Input: a set of values Si = {x\, . . . , x s } C G. 

Problem: does Si modulo dG span G/dG. 

( d , Si)-MSR Problem (Modular System Representation Problem) 
Parameters: an Abelian group G, a set Si = {x\, . . . ,x s } C G, an 
integer d. 

Input: x G G. 

Problem: find ai,...,o, 6 Z such that x G aiXi + • • • + a s x s + dG. 

d-Root Problem (dth Root Problem) 

Parameters: an Abelian group G, an integer d. 

Input: x G G. 

Problem: find rgG such that x = dr. 

2.2 Preliminaries 

Here is a first straightforward condition to solve the GHID problem. 

Lemma 1. Let G, H be two finite Abelian groups. We denote by d the order 
of H. The set S = {(aq, yi), . . . , (x s , y s )} C G X H interpolates in a group 

homomorphism if and only if for any ai, . . . , a s G Z such that a\X\-\ K a s x s G 

dG we have aiyi H + a s y s = 0. 

Let us now consider uniqueness criteria. We first notice that when the x- 
coordinates of points in S modulo dG generate G/dG (hence satisfy the MGGD 
problem), then there is at most one interpolating homomorphism. The following 
result says that this is a necessary condition as well. 

Lemma 2. Let G, H be two finite Abelian groups. We denote d the order of H. 
Let xi,...,x a G G which span G' . The following properties are equivalent. In 
this case, we say that x\,...,x t H -generate G. 

1. For all 3/i , . . . ,y s G H, there exists at most one group homomorphism f : 
G — > H such that f{xf) = yi for alii = 1, . . . , s. 

2. There exists a unique group homomorphism g> : G — ► H such that <p(xi) = 0 
for i = 1 ,... ,s, namely <p = 0. 

3. The set Horn (G/G',H) of all group homomorphisms from G/G ’ to H is 
restricted to {0}. 

I gcd(#(G/GV) = l. 

5. G' + dG= G. 

Note that the criterion U suggests that H is only involved by the prime factors 
of its order. In what follows the smallest prime factor p will be important. Note 
that if G = H, these criteria mean that x \, . . . , x s generate G. 

We can often meet the GHI and GHID problems in cryptography as the 
following examples suggest. 


Generic Homomorphic Undeniable Signatures 357 


Example 1. We take a cyclic group G of order q, H = Z q , and a generator g of 
G. The set S = {(g, 1)} interpolates in a unique group homomorphism, and the 
GHI problem is exactly the discrete logarithm problem. 

Example 2. We take a cyclic group G = H, and a generator g of G. For any 
a £ Z, S = {( g,ag )} interpolates in a unique group homomorphism: the ex- 
ponentiation to the power a. The GHI and GHID problems are exactly the 
Diffie-Hellman problem m and the Diffie-Hellman Decisional problem. 

Example 3. Let n = pq such that p. q are different odd primes and H = {—1, +1}. 
We let xi, X 2 € Z* be such that x\ is a quadratic residue modulo p and not mod- 
ulo q, and that X 2 is a quadratic residue modulo q, and not modulo p. We notice 
that S = {(xi, 1), (x 2 , —1)} interpolates in a unique group homomorphism which 
is (-/p). Since it is easy to compute (-/n), the quadratic residuosity problem 
[16] with the information x\ and X 2 is equivalent to the GHI and GHID 
problems. 

Example 4 ■ Here, we consider the well known RSA cryptosystem [21]. Let n = pq 
be an RSA modulus and G = H = Z* . Let / : Z* — > Z* be defined by f(x) = 
x e mod n for an exponent e such that gcd(e, <p(n)) = 1 [2Tj . Given enough many 
pairs (x® mod n, x,) £ Z* x Z* , i = 1 ..... ,s, for the first coordinates to generate 
Z* , the RSA decryption problem is solved by a GHI oracle.This application of 
GHI problem to the decryption problem can be adapted to every homomorphic 
encryption scheme, e.g. Paillier [20] , 

Example 5. Given d £ {2, 3, 4} and given an integer n such that d divides <p(n), 
we let G = Z* and H = Z d . The GHI problem is the MOVA d problem [19] . 

Example 6. We show here how we can apply the GHI problem to the Bilinear 
Diffie-Hellman Problem (BDHP). Let e : Gi X Gi — » G 2 be a bilinear, non- 
degenerate and computable mapping, where Gi and G 2 are cyclic groups of 
order a large prime p. Let P be a generator of Gi, we can state the BDHP as 
follows: given three random elements aP, bP and cP £ Gi, compute e(P, P)“ bc . 
(Gi resp. G 2 is written additively resp. multiplicatively.) BDHP is equivalent 
to GHI problem with S = {(P, e(aP, bP))} and xi = cP. 

Note that Examples I2I3I4I5I6I include trapdoors in order to interpolate the 
group homomorphism. Except Examples 12161 they further include trapdoors in 
order to solve the MSR problem. Also note that the order d of H is publicly 
known in Examples I1I2I3I5I61 It can further be quite small in Examples 13151 In 
what follows we focus on publicly known d and on trapdoor homomorphisms. 
We will also consider the following example inspired by PQ. 

Example 7. Let n = pq such that p = rd+ 1 and q are prime, gcd(r, d) = 1, 
gcd(g - 1 , d) = 1, with d small prime. We take G = Z* and H = Z d . We can 
easily compute a group homomorphism by first raising to the power r(q — 1) 
then computing a discrete logarithm in a small subgroup. 
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We finally provide a useful lemma to sample group elements. 

Lemma 3. Let G, H, d be defined as in Lemma [H Let £ G which 

H -generate G. The following mapping from G x Z| to G is balanced. 

g ■ {r, a\, . . . , a s ) i — e hr + a\X\ + . . . + a s x s 

2.3 Problem Reductions 

We assume that S interpolates in a group homomorphism. We notice that the 
S'-GHI problem can be solved with a single oracle call to a (d, S/j-MSR oracle 
where Si denotes the set of all x coordinates for points in S. 

Similarly, the S'-GHID problem can be probabilistically solved with a (d, Si)- 
MSR oracle by using Lemma [T] and Lemma E2 we generate a random x' = 
ax + dr + a\X\ + ■ ■ ■ + a s x s , we send it to the MSR oracle who will answer 

a\, . . . ,a' s , and we check whether ay + {a% — a' x ) y\ H + (a s — a' s )y s = 0. 

Note that once we have witnesses to find the group invariants of G and H, 
it becomes easy to solve all problems. So GHI and GHID are in NPfico-NP. 

2.4 Problem Approximations 

In this section we present our most important results. They are inspired from 
the theory of checkable proofs [2113] and linear cryptanalysis. 

Lemma 4. Given two finite Abelian groups G and H, and a set of s points 

S = {(xi,yi) | i = 1 , s}, we assume that x\,...,x a H-generate G. We let 

d be the order of H and p be its smallest prime factor. We assume that there 
exists a function f : G — > H such that 

p:= Pr \f(dr + aiXiA‘ t -- + a s x s ) = aiyi+*-- + a s y s ]>-. 

(r,a u ...,a B )euGxZ‘ d p 

The set of points {xi,yf) interpolates in a group homomorphism. Furthermore, 
given a random x Eu G, the value y = f(x) matches the unique interpolation 
with probability p. 

This improves Theorem 13 from m where we have 1/2 instead of 1/p. 

Proof. Let If C ZJ be the set of all (oi, . . . , a s ) such that aiX\-\ \-a s x s £ dG. 

We notice that the representation of any G element as a combination of x \, . . . , x s 
is uniquely defined modulo K. Following Lemma [TJ we only have to prove that 
we have a\y\ + ■ ■ ■ + a s y s = 0 for any (oi, . . . , a s ) £ K. This way, the value 
g(x) = aiyi + ■ ■ ■ + a s y s is uniquely defined by x = dr + aixi H — • + a s x s and 
g is a group homomorphism which corresponds to / with probability p. 

Let us consider a random (r, ai, . . . , a s ) Eu G x Z/. p is the probability 
that f(dr + a\X\ + • • • + a s x s ) equals a%yi + ■ ■ ■ + a s y s . This probability is 
also the average over all possible cosets of Z S d /K of the same probability when 
(ai, . . . ,a s ) is sampled in the coset only. Hence we deduce the existence of a 
coset (ai, . . . , a s ) + K such that for (r, bi , . . . , b s ) Eu G x K we have 
Pr [f(dr + (ai + h)xi H 1- (a s + b s )x s ) = (ai + bi)yi 4 b (a« + b 8 )y s ] > p. 


Generic Homomorphic Undeniable Signatures 359 


Note that a\X\-\ 1 -a s x s is now a constant x and that dr + b\Xi H 1 -b s x s 

can be written dr' where r' is uniformly sampled in G and independent from 
6-1 , , b s . Hence, there exists r' such that 

Pr [f(dr' + x) = (m + 61)2/1 H h (a s + 6 s )y s ] > p. 

( bi,...,b e )EuK 

So we have 

Pr f6ii/i H + b s y s = constantl > — . 

(b!,...,b s )euK P 

Since (61, . . . , b s ) < -b\ y\ + • • • + b s y s is a group homomorphism from K to a 
subgroup of H it must be a balanced function. Its kernel is either a subgroup of 
size at least p or the trivial subgroup {0}. Hence, the probability must actually 
be 1 and we have 612/1 + • • • + b s y s = 0 for all (61, . . . , b s ) £ K. □ 

The next result says that / can be used in order to solve the GHI problem. 

Lemma 5. Given two finite Abelian groups G and H, and a set of s points 

S = {( Xi,yi ) | i = 1, ,s}, we assume that x%,...,x s H-generate G. We 

assume that we are given the order d of H whose smallest prime factor is p and 
that we can sample elements in G with a uniform distribution. We assume that 
we have an oracle function f : G — >• H such that 

a Pr_ [f(dr + mxt + * * • + a s x s ) = oi|ft +• b a s y s ] — ^ + 6 

with 9 > 0. Let e > 0 be arbitrarily small. There exists a group homomorphism 
which interpolates S and which is computable within 40 -2 log (p/s) oracle calls 
with an error probability less or equal to e. 

Note that this substantially improves Theorem 8 from [TS] where we basically 
have 11/12 instead of 1/p. It was further conjectured in [T5] that we could replace 
it by 1/2. We made here a more precise result. 

Proof (Sketch). Due to Lemma 0] the homomorphism g exists and we have 
^ T xeuc[f( x ) = 5(2 :)] = p- 1 # 6. We use the same techniques which are used 
in linear cryptanalysis and consider the following algorithm. 

Input: x € G 
1: repeat 

2: pick r £ G, ai, . . . , a s £ at random 

3: y = /( x + dr + aiXi + ■ ** + a s x s ) - aiyi a s y s 

4: c = 0 

5: for * = 1 to n do 

6: pick r € G,ai, . . . ,a s ,a € Z d at random 

7: if f{dr + a^x\ + ■ ■ ■ + a s x s + ax) = a\y\ + • • • + a s y s + ay (T) 

then 

8: C = C+ 1 
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9: end if 

10: end for 

11: until c > rn 
Output: y 

We choose n = 4 0 _2 (p _1 + 6) log (p/e) and r = p~ l + \0 and we estimate the 
error probability of the acceptance test. We consider two types of error: 

£ i = P r i c <rn\y= g(x)] e 2 = Pr [c > rn | y /=g(x)] 

xEzjLt xGc/Ct 

We will now estimate these two values and show that they are negligible. If 
y /=g(x), then the test (T) works with probability t 2 < 1/p due to Lemma 01 
We also notice that if y = g(x), the probability that the test works is A + 0. 
Hence, using the central limit theorem we obtain 

■»"' Hm)' 

when n is large enough and where ( P denotes the distribution function of the 
standard normal distribut ion. By looking at the logarithmic derivative of the 
function f{t) = (r — t) /(■ \J t(l — t )) and noticing that this one is negative on the 
interval [0, r] we deduce that 

e 2 <*(-Vn T-P - 1 — V 

V Vp ^-p ) J 

Using t = p 1 + 2 $ provides 

£2 < 0 i-y/a 9 ] ~ ~^= (e«*- r £p-'A , 

y 2y/p~ 1 (l - p - 1 ) J \/27T V J 

where the last approximation holds when n is large enough (e small). Now, we 
substitute the expression of n in the above inequality and we obtain 



Since P ^ 1 S > 1 and | < 1 when e is small, we finally get e 2 < ej (py/2n) < pe/ 2 
where p = p -1 + 6. In a similar way, we can show that e\ < e/2. It remains 
to compute the complexity and the error probability of the algorithm. At first, 
we observe that the probability a that c < to in the algorithm is equal to 
pex + {l — p){l—e 2 ). From the estimate of e\, s 2 , we see that a « 1 — p. Moreover, 
the number of iterations is equal to AW 1 (1 — a) = 1/(1 —a) « 1/p. Hence, 
the complexity is n/p = 4(log(l/e) + log(p))/(p — |) 2 . The probability of error 
is given by YhLi « l_1 ( 1 - p) £ 2 « (1 - p)/pe 2 < e 2 / p < e/2. □ 
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3 Interactive Proof Protocol 

3.1 Proof for the GHID Problem 

Let G, H, and S = {(< 7 i, ei), . . . , ( g s , e s )} be parameters of a GHI problem, and 
let d be the order of H . We assume that we have a prover who wants to convince 
a verifier that he knows an interpolating group homomorphism / : G — * H for 
S. Let £ be an integer. He performs the following interaction with a verifier. 

GHIproof^S) 

Parameters: G, H, d 

Input: £, S= {(<?i, ei), . . . , (g s , e s )} C G x H 

1. The verifier picks r; € G and ajj £ Z d at random for i = 1, 

and j = 1, . . . , s. He computes u» = dri + a,i t igi + ■ • • + cii tS g s and 

w i = a^iei H + aj iS e s for i = He sends u\,...,ui> to the 

prover. 

2. The prover computes V{ = f(ui) for i = 1 He sends a com- 

mitment to v \ , . . . , va to the verifier. 

3. The verifier sends all rf s and a^/s to the prover. 

4. The prover checks that the Uj’s computations are correct. He then 
opens his commitment. 

5. The verifier checks that v t = for i = 1, ... ,£. 

From a practical point of view, the verifier can generate the r,’s and dij’s 
in a pseudorandom way from a seed and simply disclose the seed in the third 
step of the protocol. Further note that if d s is large enough, then the verifier can 
send h(wi, . . . , w s ) ® seed (where h is a hash function) in his first message so 
that the complete protocol can run in 2 moves instead of 4. In the second move, 
the prover simply sends seed. 

Note that we need a commitment scheme here, e.g. the trapdoor commitment 
scheme proposed by Bresson et al. [6]. Note that using trapdoor commitment 
with the verifier’s public key strengthens our protocols by providing the non- 
transferability property IIZl- 

Theorem 1. Assuming thdt gi,...,g s H-genemte an Abelian group G, let d be 
an integer and ei, . . . , e s £ H, where H is an Abelian group of order d. Let p 
be the smallest prime factor of d. We consider the GHIproofe(S) protocol with 
S = {(g 1 ,e 1 ),...,(g s ,e s )}CGxH. 

i. Completeness: assuming that the prover and the verifier are honest, the pro- 
tocol always succeeds. 

ii. Zero-knowledge: assuming that the commitment scheme is perfectly hiding, 
the above protocol is perfectly black-box zero-knowledge against any verifier. 

Hi. Proof of membership: assuming that the protocol succeeds with probability 
greater than p~ e with a honest verifier, then S interpolates in a group ho- 
momorphism. 
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iv. Proof of knowledge: for any 0 > 0, assuming that the protocol succeeds with 
probability greater than (p _1 + 6) e with a honest verifier and that the com- 
mitment scheme is extractable, for any e > 0 there exists an extractor with 
a time complexity factor 0(log(l/e)) which can compute an interpolating 
group homomorphism from the prover with probability at least 1 — s. 

Proof (Sketch). Property [I] is quite clear. Property [IT] is proven by constructing 
a simulator for the transcript of the protocol without the secret of the prover. 
Property [m] directly follows from Lemma |U For Property we use Lemma [4] 
and Lemma [H □ 

3.2 Proof for the co-GHID Problem 

Let G , H, and S = {(<?i, ei), . . . , (g s , e s )} C G x H be parameters of a GHI 
problem, and let d be the order of H. Let T = {(aq, zi), . . . , (x t , Zt)} C G x H 
be a set of t inputs of the GHID problem. We assume that we have a prover 
who wants to convince a verifier that for at least one k the answer to the GHID 
problem with ( Xk , Zk) is negative. Let i be an integer. He performs the following 
interaction with a verifier. 

coGHIproof^ (S, T ) 

Parameters: G, H, d 

Input: £, S= {(gi,ei ), . . . ,(g s ,e s )}, T = {(aq, Zi ), . . . , 

1. The verifier picks € G, ai./,,k € Z,/. and Aj G Z* for i = 

1 j = 1, . . . , s, k = 1, . . . , t, where p is the smallest prime 

dividing d. He computes := a i,j,k9j + K%k and 

Wi,k ~ Ei=i + A iZ k . Set u := (ui,i, . . . ,u^ t ) and w := 

. . . , we >t ). He sends u and w to the prover. 

2. The prover computes := /(it^fe) for i = 1, . . . ,£, k = 1, . . . ,t. 
Since w-^k — v^k = Aj (zk — yk), he should be able to find every 
A i if the verifier is honest since Wij- /=Vi,k for all i and at least 
one k. Otherwise, he sets A * to a random value. He then sends a 
commitment to A = (Ai , ... ,\f) to the verifier. 

3. The verifier sends all rife’s and aq^fc’s to the prover. 

4. The prover checks that u and w were correctly computed. He then 
opens the commitment to A. 

5. The verifier checks that the prover could find the right A. 

This protocol is inspired from denial protocol of Gennaro et al. HSJ. We can 
also transform it into a 2-move protocol. 

We notice that Aj was chosen such that it can be uniquely retrieved for every 
nonzero values of Zj that can be taken by the elements z/- — yk' s - Namely, this 
is done by the following result. 

Lemma 6. Let H be an Abelian group of order d, and a,b £ H such that b /=D 
Let A be in {1, . . . ,p — 1}, where p is the smallest prime dividing d. Then, if the 
equation a= Xb has a solution in X, then this one is unique. 
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3.3 Proof for the MGGD Problem 

Inspired by m, we propose here a proof that Si = {gi . . . . . g s } H- generate G. 
However, the signer needs expert knowledge about G since he has to be able to 
solve the ( d , SjJ-MSR and d-Root problems. Let £ be an integer. He performs 
the following protocol. 

MGGDproof £ (Si) 

Parameters: G, H, d 

Input: £, Si = {gi, . . . ,g s } C G 
1: for * = 1 to £ do 

2: The prover picks a <Si £ G at random and sends a commitment to 

6 i to the verifier. 

3: The verifier picks a <$2 € G at random and sends 82 to the prover. 

4: The prover solves (d. Si )-MSR on 8 \ + 82 and d-Root and finds 

r e G, ai, ... ,a s £ Z d such that 81 + 8 2 = dr + Ylj=i a j9j- He 
sends r, ai, . . . , a s to the verifier and opens the commitment to <5i. 

5: The verifier checks that 81+82 = dr + Ylj=t a j9j r eally holds. 

6: end for 

We can prove as in Lemma S] that if a honest verifier is convinced with 
probability greater than p~ e , then Si solves the d-MGGD problem. 

Note that this can be transformed into a non-interactive proof following 
standard techniques m- An efficient way consists of generating pseudorandom 
8 i,..., 8 i from the same seed then solving the (d, Si)-MSR and d-Root problems 
on those elements. 


4 Undeniable Signature 

4.1 Description 

We now describe our undeniable signature scheme. 

Domain Parameters. We let integers Lkey, Lsig, Icon, Iden be security pa- 
rameters as well as “group types” for Xgroup and Ygroup. (The group types 
should define what groups and which sizes to use in order to achieve security.) 

An optional parameter Ival is used in Setup Variants 3 and 4 below. 

Primitives. We use two deterministic random generators Geni and Gen 2 which 
produce elements of Xgroup and a commitment scheme. 

Setup Variant 1. (signer without expert group knowledge) 

The signer selects Abelian groups Xgroup and Ygroup of given types together 
with a group homomorphism Horn : Xgroup — > Ygroup. He computes the 
order d of Ygroup. He then picks a random string seedK and computes the Lkey 
first values (Xkey-, , . . . , Xkey Lkey ) from Geni (seedK) and Ykey ; := Hom(Xkeyj), 
j = 1 , Lkey. 
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The main problem of Setup is that the choice for (Xkey l5 . . . , Xkey Lkey ) must 
Ygroup-generate Xgroup in order to ensure non-repudiation of signatures. In 
Variant 1, Lkey must be large enough so that it is impossible to maliciously 
select a key which does not guaranty this condition. 

Setup Variant 2. (signer with a Registration Authority (RA)) 

We use here a RA whose role consists of making sure that a key was randomly 
selected. (Note that, the RA does not check if the key is valid.) 

1. The signer selects Abelian groups Xgroup and Ygroup of given type together 
with a group homomorphism Horn : Xgroup — » Ygroup. He computes the 
order d of Ygroup. He submits his identity Id together with Xgroup, Ygroup 
and d to RA. 

2. RA first checks the identity of the signer and that he did not submit too 
many registration attempts. He then picks a random string seedK that is 
sent to the signer together with a signature C for 

(Id, Xgroup, Ygroup, d, seedK) . 

3. The signer computes the Lkey first values (Xkey 1 , . . . , Xkey Lkey ) from 
Gen! (seedK) and Ykey 7 - := Hom(Xkey J ), j = 1, . . . ,Lkey. 

Here the RA basically selects the random key so Lkey can be reduced. 

Setup Variant 3. (signer with an expert group knowledge) 

In this variant we assume that the signer can solve the MSR and Root problems 
in Xgroup. It works exactly like in the Setup Variant 1, but the signer can further 
run a MGGDproof Ival in order to validate the public key so that Lkey can be 
further reduced to the smallest possible one. 

Setup Variant 4. (signer with an expert group knowledge, non-interactive) 
This variant is the same as Variant 3 except that MGGDproof is transformed 
into a non-interactive proof. 

Public Key. Kp = (Xgroup, Ygroup, d, seedK, (Ykey 1; . . . ,Ykey Lkey )) with an 
optional (Id, C) for Variant 2, an optional Ival for Variants 3,4, and an optional 
non- interactive proof for Variant 4. We say that Kp is valid if {Xkey !,..., 
Xkey Lkey } Ygroup-generate Xgroup. 

Secret Key. Kg = Horn. 

Signature Generation. The message M is used to generate Xsig-j , . . . , Xsig Lsig 

from Gen 2 (M). The signer computes Ysig fe = Hom(Xsig ; .) for k - 1 ,Lsig. 

The signature is (Ysig!, . . . , Ysig Lsig ). It consists of Lsig. log 2 d bits. 

Confirmation Protocol. Compute Xkey 1; . . . ,Xkey Lkey from the public key, 
Xsigj , . . . ,Xsig Lsig from the message, run GHIproof Icon on the set 

S = { (Xkey j , Ykey j)\j = 1, . . . ,Lkey} U {(Xsig fc , Ysig fc )|fc = 1, . . . ,Lsig}. 
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Denial Protocol. Compute Xkey-j , . . . , Xkey Lkey from the public key as well as 
Xsig! , . . . , Xsig Lsig from the message, run coGHIproof Iden on the sets 

S = {(Xkey^Ykey j)\j = 1, . . . ,Lkey}, T = {(Xsig fc , Zsig fe )|fc = 1, . . . ,Lsig} 

where (Zsig 1; . . . , Zsig Lsig ) is the alleged non-signature. 

The undeniable signature scheme of Gennaro et al. [TS] which is based on RSA 
corresponds to a special case of our scheme, namely with Xgroup = Ygroup = 
Z* , Lkey = Lsig = 1 and the classical RSA signing function as homomorphism 
Horn. Another example with Lkey = Lsig = 1 is the undeniable signature of 
Chaum [7j. He considered Xgroup = Ygroup = Z* for a prime p and the ho- 
momorphism consisting in raising an element to the power of the private key. 
In both examples the signature is quite large. The MOVA scheme [T5] is an- 
other example with Xgroup = Z* , Horn is a character of order d G {2, 3, 4}, and 
Ygroup is the subgroup of C* spanned by eT. 

4.2 Security Analysis 

Theorem 2 (Setup Variants 1,2). We consider the above undeniable signa- 
ture. Given a prime q, we let A q be the subgroup of Xgroup of all terms whose 
orders are powers of q. Given q there is a unique k q and a Qi i < . . . < a, q j~ q se- 
quence such that A q is isomorphic to Z 9 » ? ,i 0 . . . ® Z q a q ,k q ■ The probability P gen 
that {Xkey-j , . . . ,Xkey Lkey } Ygroup-generate Xgroup satisfies 



where P d is the set of all prime factors of gcd(#Xgroup, d) . 

As an application, if d is prime and if Xgroup is a product of k cyclic groups, 
we have P ge „ > 1 - fc.d“ Lkey . 

Theorem 3. We consider the above undeniable signature scheme. Assuming 
that the public key is valid, we have the following security results. 

i. If the signer and the verifier are honest, the two protocols complete: a valid 
signature will always be accepted by the confirmation protocol, and an invalid 
signature will always be rejected by the denial protocol. 

ii. LetS = {(Xkey!, Ykey^, . . . , (Xkey Lkey , Ykey Lkey )}. The scheme resists 
against existential forgery attacks provided that Gen 2 is a random oracle 
and the S-GHI problem is intractable. 

in. The confirmation (resp. denial) protocol is sound: if the signer is able to pass 
the protocol with probability q > p~ lcon (resp. q > p~ Uen ), then the alleged 
signature is valid (resp. invalid). 

iv. The confirmation protocol is private when the commitment scheme is ex- 
tractable: for any 6, e > 0, from a prover which is able to convince a honest 
verifier that a given signature is valid with probability q > (p~ l 4- 0) Icon , we 
can extract within a complexity factor of f2(9~ 2 log(p/e)) a group homomor- 
phism which solves the GHI problem with success probability 1 — e. 
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v. The signatures are invisible: for any 9,e > 0, from a distinguisher of a valid 
signature from a random one with advantage 6 > 0, we can extract within 
a complexity factor of f2(6~ 2 log(l/e)) a GHID problem solver with success 
probability 1 — e. 

vi. The confirmation (resp. denial) protocol is perfectly black-box zero-knowledge 
when the commitment scheme is perfectly hiding: we can build a simulator 
for the protocol without the secret key for any verifier. 

In short, if we take Xgroup = Z* where n is a product of two prime numbers, 
and Lsig = Icon = Iden = s 0 nUne/log 2 p, we cannot contradict the confirmation 
or denial protocols but with a probability at most 2 -Sonllne , and signatures are 
invisible provided that generators are random oracles and that the interpolation 
problem is hard. For Variant 2, we can take Lkey = .s on iine/ log 2 P and this 
generates invalid keys with probability less than 2 1_Sonline . For Variant 1, we can 
take Lkey = •‘'offline/ log 2 P so that the signer cannot create invalid keys within 
a complexity less than 2 Sonline . For Variants 3,4, Lkey can be as low as possible. 
We can take Ival = s 0 niine/log 2 p for Variant 3 (so that invalid keys are accepted 
with probability less than 2 _Sonllne ), and Ival = .s 0 ffline/ k)g 2 p for Variant 4 so 
that the signer cannot create invalid keys within a complexity less than 2 SonUne . 
We suggest s 0 fflme = 80 and s on iine = 20. 

5 Example and Further Discussions 

5.1 Setting Proposal 

We consider Example |7] with a small prime d e.g. d = 2 20 + 7. We take Xgroup = 
Z*, Ygroup = Z d, Lkey = Lsig = Icon = Iden = 1 and we consider Variant 3 
and 4 of the Setup protocol. If Xkey £ Xgroup is not a dth power residue 
then it Ygroup-generates Xgroup. For any Ykey £ Z,i there is a unique group 
homomorphism Horn such that Hom(Xkey) = Ykey. With this example we can 
sign with a single element of Z d and a public key (n, d. seedK, Ykey). 

Note that the group homomorphism computation requires raising to the 
power r in Z* and computing the discrete logarithm in a cyclic group of about 
2 20 elements. This can be precomputed in a table of 2.5 MB as detailed below. 

We first precompute a (large) table of all (Xsigj, i) with Xsig, ; = Xkey”' 
(mod p) for * = 0, 1, . . . , d — 1. Note that i can be encoded into 20 bits. Next we 
insert all (Xsig, ; , i) pairs in a hash table of 2 20 entries keyed by Xsig^: put i at 
position h(Xsigj) unless there is a collision. Resolving collisions can be done by 
standard techniques, for instance see [TO] Chapter 12, but note that resolving 
collisions is not necessary: if Xsig, is not in the table, we can look for the smallest 
j such that Xsig, i+7 - is in the table. 

Time/memory tradeoffs can also be considered. Remark also that such a 
tradeoff should not require more than the complexity of the Pollard’s rho algo- 
rithm for the computation of the discrete logarithm in our example, i.e. approx- 
imately 3000 multiplications. 
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Depending on the application, the signature size of 20 bits may be considered 
as too small. Of course, we can easily enlarge it e.g. to 48 bits. Our point is that 
signature size versus security is fully scalable here. 

The signature generation requires 1 homomorphism i.e. about one exponen- 
tiation in Z*. (Note that this is twice as fast as a 1024-bit RSA signature com- 
putation with Chinese remainders.) The complexity of the confirmation protocol 
is about 35 multiplications in Z * for the verifier (which can be compared to 17 
multiplications in Z* for RSA if we take e = 2 16 + 1) and 1 homomorphism for 
the prover. The denial protocol requires almost the same complexity. 

Complexities of this setting with all setup variants as well as those of the 
MOVA scheme with d = 2 and a 20-bit signature length are detailed in Ta- 
ble HJ The main advantage of using the above setting instead of MOVA is 
that the former strongly decreases the number of multiplications in Z* for the 
confirmation. 


Table 1. Implementation Examples 


Setup 

d 

Lsig, Icon, Iden 

Lkey 

Ival 

Signature cost 

Confirmation cost 

1 

2 

20 

80 


20 Leg. symb. 

20 Leg. symb., 730 mult. 

2 

2 

20 

20 


20 Leg. symb. 

20 Leg. symb., 280 mult. 

3 

2 

20 

2 

20 

20 Leg. symb. 

20 Leg. symb., 145 mult. 

4 

2 

20 

2 

80 

20 Leg. symb. 

20 Leg. symb., 145 mult. 

1 

2™ + 7 

1 

4 


1 Horn 

1 Horn, 65 mult. 

2 

2 20 + 7 

1 

1 


1 Horn 

1 Horn, 35 mult. 

3 

2 20 + 7 

1 

1 

1 

1 Horn 

1 Horn, 35 mult. 

4 

2 20 + 7 

1 

1 

4 

1 Horn 

1 Horn, 35 mult. 


5.2 On the MOVA Scheme 

We point out here that our scheme generalizes the MOVA scheme jTS] and im- 
proves the efficiency of the denial protocol of MOVA. An additional contribution 
to MOVA is also the improvement of some bounds related to the probability of a 
function approximating Horn from which we can compute Horn in a polynomial 
time. Our new bound with 1/p allows to formally prove the conjectured security 
level of MOVA. 

5.3 Batch Verification and Selective Convertibility 

We point out that our scheme allows a batch verification of signatures. Indeed, 
the confirmation protocol can be easily adapted in order to confirm several sig- 
natures at the same time by putting all (Xsig fc , Ysig fc ) in a single set S. 

Note that the signer with expert group knowledge can selectively convert an 
undeniable signature into a classical one by solving the MSR and Root prob- 
lems on all Xsig fc . The conversion consists of revealing the solution to those 
problems. 
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6 Conclusion 

We have exposed an undeniable signature based on a generic group homomor- 
phism interpolation and we have also analyzed the security in the random oracle 
model. The principal advantage is the size of the signature that can be chosen 
arbitrarily short depending on the required security level. Confirmation and de- 
nial can be run in a 2-move protocol. We can perform batch verification and 
have selective convertibility. From this general setting we have also proposed a 
practical example with 3-byte signatures and a complexity cost which is similar 
to RSA. We hope that this example will be completed by some various additional 
settings since group homomorphisms are common objects in cryptography. 

As future work, we also aim at extending our techniques to other crypto- 
graphic algorithms such as the designated confirmer signatures [8]. 

Acknowledgments. We wish to thank Anna Lysyanskaya and Wenbo Mao for 
helpful discussions and comments. 
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A Technical Proofs 

Proof of Lemma 0 Q] <t=> [2] [3j Straightforward. 

[3] => |H Assume that there exists a common prime factor p of #(G/G') and d. 
Then, from the structure of Abelian groups G/G' and H we know that each of 
these two groups possesses one cyclic subgroup U and V respectively of order 
p. So, we define a non trivial homomorphism that is the composition of the 
isomorphism between the two cyclic subgroups and with the reduction modulo 
U. This contradicts 0 

[4] =>■ [5l If x £ G, then d must be invertible modulo the order k of x mod G' by 
0 Let m such that m ■ d = 1 (mod k). We have m-d-x= x (mod G'). Hence, 
x — d{m ■ x) G G' and therefore x £ G' + dG. 

[5] =>■ [H If ip e Hom(G, H) is such that p\ q' = 0 and x £ G, we can write 

x = aixi + ■ ■ ■ + a s x s + dr. Thus, ip(x) = dip(r) = 0. This holds for all x £ G, 
i.e., tp = 0. □ 

Proof of Lemma 0 Let n be the order of G. Let h : G x Z® d — ► G be a function 
defined by h(r, a±, . . . , a s ) = dr + aix^ + . . . + a s x s . Obviously, h is an homo- 
morphism. It is onto G due to the property 0 of Lemma 0 Hence, it is balanced 
onto G. Let ip : G x Z® d -» G x ZJ be a function defined by <p(r, Oi, . . . , a s ) — > 

(r + q\X\ H 1- q s x s , a\ mod d,...,a s mod d), where aj — (a* mod d) = dqi. We 

have g o <p = h. Obviously, <p is balanced onto G x Z®, since (r, ai , . . . , a s ) = 
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{(r-qiX! - . . .-q a x a ,a 1 +dq 1 , . . . , a s +dq s ) | (©, ...,q s )e Z s n }. If #g 1 (ar) = to, 
we have mn s = (< 7 _ 1 (a;)) = ffh~ 1 (x) = ( dn) s . Hence, m = d s does not 

depend on a;, so 3 is balanced. □ 

Proof of Theorem [H (Sketch). The decomposition of Xgroup comes from classical 
results on the structure of Abelian groups. We observe that we can handle each 
A q independently because we can see that two elements generating two different 
A q ' s generate the direct sum of these two groups, since the two respective group 
orders are coprime. We consider B q := A q /dA q and study the probability that 
elements generate this group. If gcd(d, q) = 1, then B q is trivial. So, we focus 
only on the q’s that divide d and denote e q the largest integer such that q eq \d. 
We can also deduce that the structure of B q satisfies 

Bq — Z g “q,l ® . . . © Z q a-q,r © Z q eq © . . . Zl q eq , 

where r is the largest integer such that a q>r < e q . The probability that s elements 
does not generate B q can be approximated by the probability that these elements 
stay in one of the largest non trivial subgroups of B q , i.e. those of order #B q /q. 
The number of such subgroups is equal to k q . Thus, this probability is greater 
or equal than 1 — . Since these events are independent for the different B q s, 

the final probability is obtained by the multiplication of these probabilities. □ 

Proof of Theorem [3| (Sketch), i. The assertion 0 is straightforward. 
it. First, we show that an attacker A having access to a signing oracle can be 
simulated by an attacker without this access. Indeed, when A calls the signing 
oracle on a message M, the signing oracle will first produce a sequence of Lsig 
values Xsig 1; . . . , Xsig Lsig £ Xgroup and then computes Ysig, := Hom(Xsigj) for 
i = 1, . . . ,Lsig. From the point of view of A, this is completely equivalent to 
dispose of a random source generating pairs of the form (r,Hom(r)) since Gen 2 
is modelized as a random oracle. Assuming that Si Ygroup-generate Xgroup, we 
see that this source can be simulated by picking some random r £ Xgroup, © ’s £ 
Z d, computing x := cir+a-iXkey-i + ■ • ■ +aLkeyXkey Lkey and Hom(a;) = © Ykeyj + 

h ai.key Ykey Lkey using Lemma |3] We denote now x, the challenged element of 

the GHI problem. We use our attacker A in order to compute the Hom(Xsig i )’s 
as follows. We simulate Gen 2 by computing u := dr + x + Y^j^i ©Xkeyj for 
some random r £ Xgroup, © £ Z,/. This is indistinguishable from some uni- 
formly picked element in Xgroup. By standard proofs we show that forged sig- 
natures are necessarily one of the Gen 2 queries, so we can deduce Hom(a;) from 
Hom(u). 

in. For the confirmation, this directly comes from Theorem Q] property |m] For 
the denial, a cheating prover willing deny a valid signature has to find the value 
of A i at each round of the protocol. Since Homfu,^) = the prover does not 
learn additional information with w it k and has to find A, : from u,- ^ uniquely. He 
cannot find the A* since another distribution of the values with another A* 
is indistinguishable from the first one. Assuming that the commitment scheme 
is perfectly binding the cheating prover cannot do better than answering a ran- 
dom Aj. 
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iv. This directly comes from Theorem Q] property Hv] 

v. This works like in Lemma [5] We count how many times (x' . y') is accepted 

after having picked x' = x + dr + ctiXkeyj + ■ ■ • + ctLkeyXkey Lkey and y' = 
y + riiYkey-, H 1- a L ke y Ykey Lkey . We use n = 9~ 2 log(l/c) iterations. 

vi. For the confirmation, this comes from property |n] in Theorem [TJ For the de- 
nial, this is done as in m • □ 
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Abstract. We propose a group signature scheme with constant-size 
public key and signature length that does not require trapdoor. So sys- 
tem parameters can be shared by multiple groups belonging to different 
organizations. The scheme is provably secure in the formal model re- 
cently proposed by Bellare, Shi and Zhang (BSZ04), using random ora- 
cle model, Decisional Bilinear Difiie-Hellman and Strong Diffie-Hellman 
assumptions. We give a more efficient variant scheme and prove its secu- 
rity in a formal model which is a modification of BSZ04 model and has a 
weaker anonymity requirement. Both schemes are very efficient and the 
sizes of signatures are approximately one half and one third, respectively, 
of the sizes of the well-known ACJTOO scheme. We also use the schemes 
to construct a traceable signature scheme. 


1 Introduction 

Group signature schemes, introduced by Chaum and Van Heyst pVTj . allow a 
group member to sign a message on behalf of the group without revealing his 
identity and without allowing the message to be linkable to other signed messages 
that are verifiable with the same public key. Participants in a group signature 
scheme are a set of group members and a group manager. The role of the group 
manager is to register new users by issuing membership certificates that con- 
tain registration details, and in case of dispute about a signed message, revoking 
anonymity of the signed message by ‘opening’ the signature. In some schemes 
the functions of the group manager can be split between two managers: an issuer 
and an opener. This is a desirable property that allows distribution of trust. It is 
required that no collusion of the issuer and the opener can frame a group mem- 
ber. Group signatures are among the most important cryptographic primitives 
for providing privacy and have been used for applications such as anonymous 
credentials [2], identity escrow m , voting and bidding [I], and electronic cash 
[23] . Kiayias et al. [18] also introduced the traceable signature primitive, which 
is basically the group signature system with added properties allowing a variety 
of levels for protecting user privacy. 

In early group signature schemes Banana the size of the public key and 
the signature grew with the size of the group and so the schemes were imprac- 
tical for large groups. Schemes with fixed size group public key and signature 
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length have been first proposed in [13] and later extended in [121IIJ12]- In Crypto 
2000, Ateniese et al. (ACJT00) [I] proposed an efficient group signature scheme 
with very short length and low computation cost. This scheme is also the only 
scheme that has been proved to satisfy the informal list of security requirements 
of group signature schemes. Ateniese and de Medeiros (AdM03) proposed an 
efficient group signature scheme [2] that is ‘without trapdoor’ in the sense that 
none of parties in the system including the group manager need to know the 
trapdoor. That is the system trapdoor is only used during the initialisation and 
to generate system parameters. The advantage of this property is that the same 
trapdoor information can be used to initiate different groups. The importance 
and usefulness of this property in real-world applications, for example when the 
group signature scheme is used as a building block of an anonymous credential 
system among a number of organizations that need to communicate and trans- 
fer information about users while protecting their privacy, have been outlined in 
[2]. A drawback of AdM03 scheme is that it has a single group manager who is 
responsible for registration of users and opening of signatures, and it is not pos- 
sible to separate the two functionalities. In AdM03 scheme, the group manager 
stores the certificate (r, s ) of each member. The signature of a group member 
contains elements x and E x satisfying the equation Ei = x r , and so, to revoke 
a signature, the group manager (or any party with the knowledge of the certifi- 
cates) can try all certificates to find the one satisfying the equation. This is an 
computationally expensive process. The security proof (corrected version) is for 
the informal list of security requirements, and is given in the generic model [3]. 

Security of a group signature scheme has been traditionally proved by show- 
ing that it satisfies a list of informally defined requirements. Bellare et al. 0] gave 
a formal security model (BSZ04) for (partially) dynamic groups with four secu- 
rity requirements (Correctness, Anonymity, Traceability and Non-frameability). 
The model uses various oracles including an Open oracle that takes a signed 
message and reveals the identity of the signer. The ACJT00 scheme although 
satisfies the conventional list of requirements but cannot be proved secure in the 
formal model mainly because of the inclusion of the Open oracle in the model. 
Kiayias et al. [T5] proposed an extension (KY04 scheme) of ACJT00 scheme that 
is proved secure in their formal model. A new direction in constructing group 
signature schemes is to use bilinear pairings to shorten the lengths of the signa- 
ture and key. Boneh et al. [7] proposed a short group signature scheme (BBS04) 
based on the Strong Diffie-Hellman assumption and a new assumption called 
the Decisional Linear assumption. The scheme is provably secure in a formal 
model where the Opening oracle is not available and the Non-frameability prop- 
erty is not required, in comparison with the BSZ04 model. They also showed 
how to construct an extension, which provides Non-frameability (exculpability) . 
Based on the LRSW assumption [22], Camenisch and Lysyanskaya [TT] pro- 
posed a group signature scheme (CL04) derived from a signature scheme which 
allows an efficient zero-knowledge proof of the knowledge of a signature on a 
committed message, and used it to construct an efficient anonymous credential 
system. 
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Our Contribution 

In this paper, we first propose a new efficient group signature scheme with a num- 
ber of attractive properties and prove its security in the BSZ04 model under the 
Decisional Bilinear Diffie-Hellman and Strong Diffie-Hellman assumptions, using 
random oracle model. We then give an efficient variant of this scheme and prove 
its security in the reduced version of BSZ04 model. The only difference between 
the original BSZ04 model and the reduced version is in modelling anonymity 
property, as in the reduced version, the adversary does not have access to the 
Open oracle. This is a plausible model for all cases that the opener is a highly 
trusted entity and cannot be accessed by the adversary. We also extend the 
variant scheme to a provably secure traceable signature scheme. 

All proposed schemes have fixed lengths for group public key and signature, 
and so can be used for large size groups. Using elliptic curve cryptography in 
our schemes results in shorter lengths for signatures and keys. For example, for 
a comparable level of security as the ACJTOO scheme with 1024 bit composite 
modulus, our group signature schemes require elliptic curve groups of order 170 
bit prime, resulting in the sizes of signatures in our two schemes to be one third 
and one half, respectively, of the size in ACJTOO scheme. For higher security 
levels this ratio will be smaller. 

Our schemes can be converted into identity escrow systems or extended to 
support efficient membership revocation, as shown in |26j . The schemes are 
trapdoor-free. The only other trap-door free scheme is the AdM03 scheme, which 
uses a trapdoor in the initialisation of the system and assumes that the initial- 
ising party “safely forgets” the trapdoor. An advantage of our schemes over 
AdM03 scheme is that they allow separation of issuer and the opener, hence 
distribution of trust. Finally in our schemes, the interactive protocol underly- 
ing the signature scheme achieves honest verifier perfect zero-knowledge without 
any computational assumption whereas in the ACJTOO and KY04 schemes, the 
corresponding protocols achieve honest verifier statistical zero-knowledge under 
the Strong RSA assumption. 

The paper is organized as follows. Section 2 gives related background and 
section 3 describes our group signature scheme and its security proofs. Section 
4 gives a modification of BSZ04 formal model and a variant group signature 
scheme, and proves that the variant scheme and ACJTOO scheme are secure 
in the modified model. Section 5 describes our traceable signature scheme and 
section 6 provides efficiency comparison with ACJTOO scheme. 


2 Preliminaries 

2.1 Bilinear Pairings 

Let Gi,G 2 be cyclic additive groups generated by Pi and P 2 , respectively, both 
with order p, a prime, and G m be a cyclic multiplicative group with the same 
order. Suppose there is an isomorphism : G 2 — » Gi such that 'ipiP'i) = Pi- Let 
e : Gi X G 2 — > Gm be a bilinear pairing with the following properties: 
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1. Bilinearity: e(aP, bQ) = e(P, Q) ah for all P G Gi, Q G G 2 , a,b G Z p 

2. Non-degeneracy: e(Pi,P 2 ) /= 1 

3. Computability: There is an efficient algorithm to compute e(P, Q) for all 
P G Gi, Q G G 2 

For simplicity, hereafter, we set Gi = G 2 and Pi = P 2 but our group signature 
schemes can be easily modified for the case when Gi f=G 2 - For a group G of 
prime order, hereafter, we denote the set G* = G\{0} where O is the identity 
element of the group. 

We define a Bilinear Pairing Instance Generator as a Probabilistic Polynomial 
Time (PPT) algorithm Q that takes as input a security parameter l l and returns 
a uniformly random tuple t = (p, Gi, Gm, e, P) of bilinear pairing parameters, 
including a prime number p of size l, a cyclic additive group Gi of order p, a 
multiplicative group G m of order p, a bilinear map e : Gi X Gi — » Gm and a 
generator P of Gi. 

2.2 Complexity Assumptions 

For a function / : N — > R + , if for every positive number a, there exists a positive 
integer lo such that for every integer l > Iq, it holds that /(/) < l~ a , then / 
is said to be negligible. If there exists a positive number ao such that for every 
positive integer l, it holds that f(l) < Z“°, then / is said to be polynomial-bound. 

The g-SDH assumption originates from a weaker assumption introduced by 
Mitsunari et. al. J23] to construct traitor tracing schemes [28] and later used by 
Zhang et al. j3D] and Boneh et al. [S] to construct short signatures. It intuitively 
means that there is no PPT algorithm that can compute a pair (c, jrj^P), where 
c G Z p , from a tuple (P, xP , . . . , x q P), where x Gr Z*. 

q-Strong Diffie-Hellman (<?-SDH) Assumption. For every PPT algorithm 
A, the following function Adv ^ l ) is negligible. 

Adv% SDH (l ) = Pr[(A{ t, P, xP , . . . , x q P) = (c, -^r c P)) A (cG Z p )] 

where t = (p, Gi,GM,e,P) <— G(l l ) and x <— Z*. 

Intuitively, the DBDH assumption [B] states that there is no PPT algo- 
rithm that can distinguish between a tuple (aP,bP, cP, e(P, P) abc ) and a tuple 
(aP,bP,cP, r), where P Gr G'* u (i.e., chosen uniformly random from G'| f ) and 
a, b, c Gr Z*. It is defined as follows. 

Decisional Bilinear Diffie-Hellman (DBDH) Assumption. For every PPT 
algorithm A, the following function Adv^DH^ ne gHgi})i e _ 

Adv% BDH {l) = \Pr[A(t,aP,bP,cP,e(P,P) abc ) = 1]- 
Pr[A(t, aP, bP, cP, F) = 1]| 

where t = (p, Gi,Gm> e, P) f— G( l l ), P <— G^- and a,b,c<— Z*. 
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2.3 Bilinear Pairing Versions of El Gamal Public Key System 

Based on the DBDH assumption, we can construct two bilinear pairing ver- 
sions of El Gamal public key system. El Gamal ppl provides Indistinguishability 
against adaptive Chosen Plaintext Attack (IND-CPA) and El Gamal BP2 provides 
Indistinguishability against adaptive Chosen Ciphertext Attack (IND-CCA) in 
the random oracle model. Due to space limitation, we only provide description 
of El Gamal SP2 . This is the bilinear pairing version of the scheme presented and 
proved by Fouque and Pointcheval Description of El Gamal BP1 can be found 
in the full version of this paper [25] . 

Key generation: Let p, Gi, Gm, e be bilinear pairing parameters, as defined above, 
and G be a generator of Gi. Suppose x a , Xb Gr Z* and O a = e(G, G) Xa and Ob = 
e(G, G) Xb . The public key pk = ( G,O a ,Ob ) and the secret key is sk = (x a ,Xb). 
Choose a hash function Hi : {0, 1}* — ► Z p (a random oracle). 

Encryption: Plaintext A G G M can be encrypted by choosing t a ,tb Gr Z* 
and computing (E a ,A a ) = (t a G, AO f 0 "), (E b ,A b ) = (t&G, AO'ff) and a non- 
interactive zero-knowledge proof c = (c, p a . pb) of equality of plaintexts between 
(E a ,A a ) and (Eb,Ab). The proof c can be computed by choosing w a ,Wb Gr Z p 
and computing c = (G| 1 | |© fa | |^7 a 1 1 | |£7 b 1 1 | |zr; 6 G| | ) , p a = 

w 0 , — t a c and pb = Wb + he. The ciphertext is (E a , A a , E b . A h , c). 

Decryption: Given a ciphertext (E 0 . A a . Eb,Ab,<;), first check the validity of c by 
verifying 

clHi{G\\O a \\Ob\\E a \\A a \\Eb\\A b \\p a G + cE a \\p b G - cE b \\O^O p b b {A a / A b ) c ) 
then compute the plaintext A = A a /e(E a , G) Xa = Ab/e(Eb, G) Xb . 

Security: The security of El Gamal PP2 system is stated in Theorem [T] 

Theorem 1. El Gamal BP2 encryption scheme is IND-CCA if DBDH assump- 
tion holds, in the random oracle model. 

3 The Group Signature Scheme 

3.1 Overview 

Our group signature scheme is built upon two ordinary signature schemes. The 
first one is used in the Join, Iss protocol for the issuer to generate a signature 
(a,;, Si) for each Xi, which is randomly generated by both a member and the 
issuer, but known only to the member. The second ordinary signature scheme 
is used in the GSig algorithm as the non-inter active version of a zero-knowledge 
protocol, that proves the signer’s knowledge of ( ai,Si ) and Xj. The security of 
the two signature schemes underlies the security of the group signature scheme. 

Our group signature scheme is constructed in cyclic groups with bilinear 
mappings. For simplicity, we present the scheme when the groups Gi and G 2 
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are the same, however, it can be easily modified for the general case when Gi /= 
G 2 . The users do not perform any pairing operation when signing, but pairing 
operation play an important role in the verification algorithm G Vf. Intuitively, 
bilinear pairings allow a party, given A,B,C,D £ Gi, to prove that IoqaB = 
logcD without knowing IoqaB or IoqaC. This is not possible in cyclic groups 
without bilinear pairings and where the DDH assumption holds. 

3.2 Descriptions 

We describe our group signature scheme according to the BSZ04 model, which 
is omitted in this paper due to space limitation. Our group signature scheme 
consists of two group managers (the issuer and the opener), and users with 
unique identities i £ N (the set of positive integers). Each user can join the group 
and become a group member. The scheme is specified as a tuple QS1 =(GKg, 
UKg, Join, Iss, GSig, G Vf, Open, Judge) of polynomial-time algorithms which are 
defined as follows. We assume that the group size and the number of queries 
asked by the adversary are polynomially-bounded by the security parameter l. 

GKg: Suppose l is a security parameter and the Bilinear Pairing Instance Gen- 
erator Q generates a tuple of bilinear pairing parameters t = (p. Gi, G«, e, P ) •*— 
G{ 1 ! ), that is also the publicly shared parameters. Choose a hash function 
H 2 : {0, 1 }* — * Z p , which is assumed to be a random oracle in the security 
proofs. Choose Po, G. H e R Gi, x,x' a ,x' b £r Z* and compute P pu b = xP, (~) a = 
e(G, G) x '«- and &h = e(G, G) x ' b . The group public key is gpk = ( P , Po, P pu b , H, G, 
O „ , Ob), the issuing key is ik = x, and the opening key is ok = (x' a , x' h ). 

UKg: This algorithm generates keys that provide authenticity for messages sent 
by the user in the (Join, Iss) protocol. This algorithm is the key generation algo- 
rithm Ks of any digital signature scheme (K$, Sign, Ver) that is unforgeable 
against chosen message attacks (UNF-CMA). A user i runs the UKg algorithm 
that takes as input a security parameter l l 2 3 and outputs a personal public and 
private signature key pair (upk[i),usk[i]). Public Key Infrastructure (PKI) can 
be used here. Although any UNF-CMA signature scheme can be used, but using 
schemes, whose security is based on DBDH or SDH assumptions, will reduce 
the underlying assumptions of our group signature scheme. One example of such 
scheme is in [5]. 

Join, Iss: In this protocol, a user i and the issuer first jointly generate a random 
value Xi £ Z* whose value is only known by the user. The issuer then generates 
( cti , Si) for the user so that e(ajP + P pu b, Si) = e(P, aqP + Po). The user uses 
usk[i] to sign his messages in the protocol. Note that the formal model assumes 
the communication to be private and authenticated. We also assume that the 
communication is protected from replay attacks. The protocol is as follows. 

1. user i — > issuer: I = yP + rH, where y, r G R Z*. 

2. user i 4 — issuer: u, v G R Z*. 

3. The user computes Xi = uy + v, Pi = XiP. 
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4. user i — > issuer: Pj and a proof of knowledge of (a;,;, r') such that Pi = XiP 
and vP + ul — Pi = r'H (see [T2] for this proof). 

5. The issuer verifies the proof, then chooses a, G/j Z* different from all corre- 
sponding elements previously issued, and computes Si = J|j|jF| + P 0 ). 

6 . user i < — issuer: a^, Si . 

7. The user computes = e(P, Si), verifies if e(a,P + P pu b- Si) = e(P,XiP + 
Po), and stores the private signing key gsk[i) = ( Xi,cii,Si,Ai ). Note that 
only the user knows X{. The issuer also computes A, and makes an entry in 
the table reg: reg[i] = ( i,Ai , (Join, Iss) transcript). 

GSig: A group signature of a user i shows his knowledge of (a*, Si) and a secret 
Xi such that: e(a t P + P pu b, Si) = e(P, XiP + Po). The signature does not reveal 
any information about his knowledge to anyone, except for the opener, who can 
compute Ai by decrypting an encryption of that value. The algorithm for a user 
i to sign a message m G {0, 1}* is as follows. 

1. Encrypt Ai by El Gamal BP2 with public key (G. 0 a , 0 b ) as (E a = tG, A a = 
AiO^Eb, Ab,c). 

2. Perform the non-interactive version of a protocol, which we call the Signing 
protocol, as follows. Generate n, ..., r%, ko, ..., k b Gr Z* and compute 

(a) U = nimP + P pub ); V = r 2 Si] W = n r 2 (xiP + P 0 ); X = r 2 U + r 3 H ; 
T\ = kiP + k 2 P pub + fco-ff; T 2 = k 3 P + k 2 Po\ T 3 = k^U + k 3 H\ T4 = 

_ jfc 4 P a ; ]J = G k 5 A~ ki . 

(b) c = H 2 {gpM\E a \\AjE b ^Mm\V\\W\\X ||T 1 ||...||T 4 ||i7||m). 

(c) Compute in Z p : so = ko + cr3; si = k\ + crir 2 ai\ s 2 = k 2 + cr\r 2 \ 
s 3 = k 3 + crir 2 xn S 4 = &4 + cr 2 ] s b = k b + cr 2 t. 

3. Output the signature (c, so, ..., S 5 , U, V, W, X, E a ,A a ,E b ,A b , g) for m. 

GVf: The verification algorithm for m, (c, s 0 , ■■■, S 5 , U, V, W, X, E a ,A a . E h . A h . ?) 
outputs accept if and only if verifying the proof c outputs accept and the following 
two equations hold: e(U,V) = e(P,W) and c = H 2 {P\\P 0 \\P pub \\H\\G\\O\\E a \\A a 
WEhWAbMUWVWWWXWsiP+s^puh+soH-cXWssP+s^o-cWWsiU+soH- 
cX\\s 5 G - s 4 E a \\0 s a 5 A- s *e(P,eV)\\m). 

Open: To open m and its valid signature (c, sq, S 5, U, V, W, X, E a ,A a ,E b ,A b , 
c) to find the signer, the opener performs the following steps. 

1. Use GVf algorithm to check the signature’s validity. If the algorithm rejects, 
return (0, e), where e denotes an empty string. 

2. Compute Ai = A a e(E a ,G)~ x '°- and find the corresponding entry i in the 
table reg. If no entry is found, return (0, e). 

3. Return reg[i] and a non-interactive zero-knowledge proof g of knowledge of 
x' a so that 0 a = e(G. G) x « and A a /Ai = e(E a , G) x '« (see [H] for this proof). 

Judge: On an output by the Open algorithm for a message m and its signature 
w, the Judge algorithm is performed as follows: 
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1. If Open algorithm outputs (0,e), run GVf algorithm on rn. u>. If GVf rejects, 
return accept; otherwise, return reject. 

2. If Open algorithm outputs (reg[i],g), return reject if one of the following 
happens: (i) on m,w, GVf algorithm rejects; (ii) verification of the proof 
q rejects; (iii) the (Join, Iss) transcript is invalid with regard to upk[i}: (iv) 
Ai f=e(P, Si) where Si is extracted from the (Join, Iss) transcript. Otherwise, 
return accept. 

Remarks: 

— Our scheme is trapdoor-free. This improves efficiency and manageability, and 
various groups can share the same initial set-up p, Gi, Gjvr, e, P, Pq, G, H. 

— Our Signing protocol achieves honest verifier perfect zero-knowledge and 
does not rely on any complexity assumption. This indicates a higher level of 
unconditional security: from a signature, an adversary with unlimited power 
(but without access to the reg table) can compute only a part of the signer’s 
registration information (Si), whereas, in the ACJTOO and KY04 schemes, 
the adversary can find all parts of the signer’s private signing key. 

3.3 Security Proofs 

Theorem 2. The group signature scheme GS1 provides Correctness. 

Theorem 3. The group signature scheme GS 1 provides Anonymity in the ran- 
dom oracle model if the Decisional Bilinear Diffie-Hellman assumption holds. 

Theorem 4. The group signature scheme QS1 provides Traceability in the ran- 
dom oracle model if the q-Strong Diffie-Hellman assumption holds, where q is 
the upper bound of the group size. 

Theorem 5. The group signature scheme QS 1 provides Non-frameability in the 
random oracle model if the Discrete Logarithm assumption holds over the group 
Gi and the digital signature scheme (Ks, Sign, Ver) is UNF-CMA. 

Proofs of these theorems can be found in the full version E3- We provide 
here the proofs of two important properties that underlie these theorems, i. e. 
the Zero-knowledge property of the Signing protocol in GSig algorithm and the 
Coalition-Resistance of GS1 and GS 2. In our definition, Coalition-Resistance 
intuitively means that a colluding group of signers, with the knowledge of the 
opening key and access to some oracles, should not be able to generate a new valid 
user private signing key. For a group signature scheme GS, a PPT adversary A, 
a PPT predicate U that can determine the validity of a user private signing key, 
and any security parameter l £ N, the formula of the experiment for Coalition- 
Resistance is as follows. 

Experiment Expgf^^ff) 

(gpk, ik, ok ) «- GKg(l'); CU «- 0; HU «- 0 

gsk' <- A(gpk, ok : CrptU(-, •), SndTol(-, •), AddU(-), RReg(-), USK(-)) 

If gsk' £ {<7sfc[«]| i £ CU U HU} then return 0 else return U(gpk,gsk’) 
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HU is a set of honest users; CU - a set of corrupted users; GSet - a set of 
message-signature pairs ; AddU(-) - add user oracle; CrptU(-,-) - corrupt user 
oracle; SndTol(-,-) - send to issuer oracle; USK(-) - user secret keys oracle; 
RReg(-) - read registration table oracle. The group signature scheme QS pro- 
vides Coalition- Resistance if the following function Advg^jfu (l) is negligible. 

Advf^il) = Pr [Expf^l) = 1] 

Lemma 1. The interactive Signing protocol underlying the GSig algorithm is a 
(honest-verifier) perfect zero-knowledge proof of knowledge of (a,, Sf), x* and t 
such that e(aiP + P pu b, Si) = e(P, XiP + Po), E a = tG and A a = e(P, . 

Proof. The proof for completeness is straightforward. The proofs of Soundness 
and Zero- knowledge property are as follows. 

Soundness: If the protocol accepts with non-negligible probability, we show that 
the prover must have the knowledge of (a,, Si), x, and t satisfying the rela- 
tions stated in the theorem. Suppose the protocol accepts for the same commit- 
ment (U, V, W, X, Ti , ..., Z4, 17), two different pairs of challenges and responses 
(c, so, ...S5) and (o', s ' 0 , ..., s' 5 ). Let fi = s fe a ; , i = 0,...,5, then: X = fiP + 
f2P pu 6 + foH ; W= f 3 P+ / 2 P 0 ; X = U U + fofe E a = fijfeG; e(P,V) = 
O-EAff- so U = /,/, 'P + hf^P pu w 

Let at = fife 1 , St = feW, Xi = f 3 fe\ t = /5/4- 1 , then E a = tG, A a = 
e(P,S i )& t a and e{ ai P + P pub , Sf) = e(P, Xi P + P 0 ), as e(U,V) = e(P,W). So the 
prover have the knowledge of (a*, S,;), x, and t satisfying the relations. 

Zero-knowledge: The simulator chooses c,so,---S5 Gr %p, b Gr Z*, X,V Gr Gi 
and compute U = bP, W = bV, T\ = s\P + S2P pu b + «o H — cX, T 2 = S3 P + 
s 2 P 0 — cW, T 3 = S4U + soH — cX, P 4 = s$G — SiE a and II = 0 % 5 A~ Si e(P, cV). 
We can see that the distribution of the simulation is the same as the distribution 
of the real transcript. 

Lemma 2. If the q-SDH assumption holds, then the group signature schemes 
GSl and QS2, whose group sizes are bounded by q, provide Coalition-Resistance, 
where the predicate U is defined as: 

U((P, P 0 , P P ub, ■■■), {xi, a f , Si, A)) = 1 e( ai P + P pub , S t ) = e(P, x t P + P 0 ). 

Proof. We prove the lemma for both GSl and QS2. Suppose there is a PPT 
adversary A that can break the Coalition-Resistance property of GSl or QS2 
with respect to the predicate U defined above. Let the set of private signing keys 
generated during As attack be {(A, a, , Si, A)}i =1 and let his output be a new 
private signing key (x* ,a* , S* , A*) with non-negligible probability (that means 
( a*,S *) {(a*, 5,)}| =1 ). We show a construction of a PPT adversary B that can 

break the g-SDH assumption. Suppose a tuple challenge = (Q, zQ, . . . , z q Q) is 
given, where z Gr Z*; we show that B can compute (c, 1 / (z+c)Q), where cG Z p 
with non-negligible probability. We consider two cases. 
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Case 1: This is a trivial case, where A outputs S* £ {Si,...,S q } with non- 
negligible probability. In this case, B chooses x, x' a , x' b £ R Z* and G, H £ R Gi, 
gives A the group signature public key (P = Q,P 0 = zQ, P pub = xP, H, G, O a = 
e(G,G) x *,O b = e(G,G) x >‘) and the opening key ( x' a ,x ' b ) (no x' b ,G' b in case of 
GS2), and simulates a set of possible users. Then B can simulate all oracles 
that A needs to access. Suppose a set of private signing keys {(a;*, a*, Si, A,J}® =1 
is generated and A outputs a new (x* , a* , S* , A*) with non- negligible proba- 
bility such that S* £ {Si, S q }. Suppose S* = Sj, where j £ {1 , ..., q}, then 
a ^ +x ( x*P+Po ) = ^^{xjP+Po), so (cij — a*)Po = (a*Xj — ajx* + XjX — x*x)P. 
Therefore, z is computable by B from this, and so is (c, l/(z + c)Q), for any 
c i Z p . 

Case 2: This is when the first case does not hold. That means A outputs S* ^ 
{Si, ..., S q } with non-negligible probability. Then B plays the following game: 

1. Generate a,ai,Xi £ R Z*, i = 1, where a,;S are different from one an- 
other, then choose m £ R {1, ..., q}. 

2. Let x = z — a m (B does not know x) , then the following P,P pub ,P 0 are 
computable by B from the tuple challenge. 

<? 

P = {z + ai- a m )Q 

Q 

P pub = xP= (z- a m ) J^[ ( z + at ~ a m)Q 
P 0 = a\{{z + a i -a m )Q-x m ( z + ai -a m )Q 

3. Generate x' a , x' b £ R Z* and G,H £ R G-i and give A the group signature pub- 
lic key (P,Po,P pu b,H,G,0 a = e(G, G) x «, O b = e(G, G) x>h ) and the opening 
key (x' a , x b ) (no x' b , 0' b in case of QS 2) and simulates a set of possible users. 

4. With the capabilities above, B can simulate oracles CrptU (•,•), RReg(-) and 
USK(-)) that A needs to access. For AddU(-) or SndTol(-, •), B simulates the 
addition of an honest or corrupted user i as follows. As playing both sides of 
the Join, Iss protocol or being able to extract information from A, B simulates 
the protocol as specified so that the prepared above are computed in 
the protocol to be the corresponding parts of the user i’s private signing key. 
B can compute as follows: 

-If i = m, then S m = ^( x m P + P 0 ) = + a i ~ a m)Q- 

This is computable from the tuple challenge. 

- If i /=m, then S t = 04 |||x ! P + P 0 ) = (ar» - x m ) A*n,i( z + a i ~ 
a m)Q + aUU j a( z ^ a -'i — a m)Q- This is computable from the tuple 
challenge. 

5. Get the output (x*, a*, S* , A*) from A, where S* = —{x*P+ Po ) = 

z+a*-a m ( aZ + x * ~ x m) n?=l,i/7n(' 2 + a i ~ a m )Q 
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We can see that the case az+x*— x m = a(z+a*—a m ) happens with negligible 
probability, as it results in S* = S m . So the case az + x* — x m f=a(z + a* — a m ) 
happens with non- negligible probability t\. Suppose in this case, the probability 
that a* G {ai,...,o g } is e%. Then the probability that a* ^ {ai, ..., a ? }\{a m } is 
ei — ~—C 2 (as m (zr {1, ...,?}), which is also non-negligible if q is polynomially 
bound by the security parameter l. If az + x* — x rn f=a(z + a* — a m ) and 
a* £ {oi, ..., a f/ }\{o m }, then z+a }_ a Q is computable from the tuple challenge 
and S* and so B can compute (c, j^Q), where c = a* — a m . 

4 Variations 

4.1 Weak Anonymity Requirement 

We introduce this security requirement to account for a class of group signa- 
ture schemes, including ACJTOO scheme, which can not be proved to achieve 
Anonymity requirement. Weak Anonymity requirement is defined exactly the 
same as Anonymity requirement, except that the adversary does not have ac- 
cess to the Open(-,-) oracle. In practice, when the opener is assumed to be 
uncorrupted as in Anonymity requirement, it could be hard for the adversary to 
have access to the Open oracle. As Open oracle is not used in the conventional 
list of requirements, the same argument as in 0] shows that Weak anonymity, 
Traceability and Non-frameability are sufficient to imply the conventional fist of 
requirements. 

4.2 A Variant Group Signature Scheme, GS2 

The scheme QS2 is the same as QS 1, except that in the signature, A, : is encrypted 
by El Gamal BP1 encryption scheme instead of El Gamal BP2 . So in GKg, x' b and 
Ob are not generated and in GSig, Ai is encrypted by El Gamal BP1 public key 
( G,O a ) as (E a = tG,A a = A, ; 6)‘ ). So there is no E b , A b or c in the signature 
and in the executions of GSig, GVf, Open and Judge algorithms. Security of QS2 
is stated in Theorem [BJ whose proof is shown in the full version m- 

Theorem 6. QS2 provides Correctness. QS2 provides Weak Anonymity if the 
Decisional Bilinear Diffie- Heilman assumption holds. QS2 provides Traceability 
in the random oracle model if the q-Strong Diffie- Heilman assumption holds, 
where q is the upper bound of the group size. QS2 provides Non-frameability in 
the random oracle model if the Discrete Logarithm assumption holds over the 
group Gi and the digital signature scheme (Ks, Sign, Ver) is UNF-CMA. 

4.3 Do ACJTOO and GS2 Schemes Provide Anonymity? 

We first state the security of the ACJTOO scheme in Theorem [7] The ACJTOO 
scheme refers to the scheme proposed in [T], plus some simple extensions to 
accommodate the Judge algorithm (defining the UKg algorithm as in our scheme, 
using usk[i] to sign messages in the Join, Iss protocol, and verifying signatures 
in the Open and Judge algorithms). The methodology of the proof for Theorem 
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[7] is very similar to the proof of Theorem [6] and the exact details of each step 
can be extracted from the proofs in [T5] . 

Theorem 7. The ACJTOO scheme provides Correctness; Weak Anonymity if 
the DDH-Compo-KF assumption holds; Traceability in the random oracle model 
if the Strong RSA assumption holds; Non-frameability in the random oracle 
model if the Discrete Logarithm assumption holds over the quadratic residues 
group of a product of two known large primes, and the digital signature scheme 
for UKg is UNF-CMA. (See fffif for assumptions used in this theorem). 

It is an open question if the ACJTOO and QS2 schemes provide Anonymity, 
in line with the open problem whether a combination of an El Gamal encryption 
(IND-CPA) and a Schnorr proof of knowledge of the plaintext can provide IND- 
CCA. This combination has been proved to provide IND-CCA in the random 
oracle model, but the proof has required either another very strong assumption 
[25] or is in generic model [27] . In ACJTOO and QS2 signatures, the identity- 
bound information is encrypted by variations of El Gamal encryption and the 
other part of the signatures proves knowledge of the information. The Open 
oracle plays a similar role as the Decryption oracle in the model of IND-CCA. 

4.4 Variants Based on the DDH Assumption 

We can build variants of QS1 and QS2, whose security is based on the DDH as- 
sumption over the group G M instead of the DBDH (DDHV) assumption. Specif- 
ically, Ai will be encrypted by the normal El Gamal encryption scheme or the 
twin-paradigm extension of El Gamal encryption scheme (proposed in [IT]). The 
Open algorithm in these variant schemes requires one less pairing operation than 
in QS1 and QS2. 

We can actually provide a group signature with 4 options, where the users, 
the issuer and the opener use the same keys for all options. The first two options 
are GS1 and QS2, offering smaller signature size and more efficient signing and 
verification. The last two options are the variant schemes based on the normal 
DDH assumption, with more efficient opening. 

5 A Traceable Signature Scheme 

We extend QS2 to be a traceable signature scheme TS =(Setup, Join, Sign, 
Verify, Open, Reveal, Trace, Claim, Claim-Verify) with similar advantages over the 
only other traceable signature scheme [T5] . 

Setup: This is the same as GKg for QS2, but the group public key also includes 
a Q €r Z*. The group public key is gpk = ( P , Pq, P pu b , Q, H, G, O a ), the issuing 
key is ik = x, and the opening key is ok = x' a . Choose a hash function H3 : 
{0, 1}* — > Z p (a random oracle). 

Join: This protocol is the same as the Join, Iss protocol in Section 1X21 except for 
the following. The GM also chooses x. c Gr Z*, computes Si = (Pi+XiQ+Po) 


384 L. Nguyen and R. Safavi-Naini 


at step 5 and sends the user a*, Si, X{ at step 6. In the last step, the user computes 
Ai = e(P, Si), verifies if e(aiP+P pu b, Si) = e(P, XiP + XiQ + Pq) , and stores the 
private signing key gsk[i\ = (xi, afj, a*, Si, A*). The GM also computes A* and 
stores it with the protocol’s transcript. 

Sign: The algorithm for an user i to sign a message m £ {0, 1}* is as follows. 

1. Compute E a = tG, A a = AiQ *, = 0 XiT , T 2 = O r a , T 3 = 0 „ ir ' and 

X 4 = where t,r,r' Gr Z*. 

2. Generate n , ..., r 3 , ho , ..., k& €r Z* and compute 

(a) U = niaiP + P pub )-, V = r 2 Si-, W = rqr^aqP + x,Q + P 0 ); X = r 2 U + 

r 3 H; Ti = k\P -\-k 2 P pub -\-k(,H', T 2 = k 3 P +kQQ-\-k 2 Po', T 3 = k^U + koH', 
T 4 = k 5 G - k 4 E a : II = G^A~ ki - 'T, = E 2 = . 

(b) C = W3(P||Po||Pp U 6||-H‘||G||0||KPa||^6P6|k||C/||V r ||W||X||Ti||...||T 4 
l|P||^i||^||m). 

(c) Compute in Z p : so = ko + cr 3 \ si = k\ + crir 2 ai\ s 2 = k 2 + crir 2 ; 
S3 = k 3 + cr\r 2 Xi\ s 4 = fc 4 + cr 2 ; s 3 = k 3 + cr 2 f; S6 = ^6 + crir 2 Xi 

3. Output the signature (c, s 0 , ..., s fi , U, V, W. X, E a , A a , T - t , T 2 , T 3 ,T 4 ) for m. 

Verify: The verification algorithm for m, (c, So> •••> S6 ; U, V, W, X, E a , A a , T 4 ,T 2 , 
P 3 , r 4 ) outputs accept if and only if the following two equations hold: (i) e(U, V) 
= e(P,W) and (ii) c = W 3 (P||^||P I m6||^||G||e||Ba||A,||£t||^lkll^||V||W||X 
\\siP + s 2 P pu b + s 0 H - cX\\s 3 P + s e Q + s 2 P 0 - cW\\s4U + s 0 H - cX\\s 5 G - S4,E a 
1 1 0 s a *A-°*e(p, cV) \\rr»r? II r 3 - 52 rf ||m) 

Open: To open m and its valid signature (c, so, .... S5, U, V, W, X, E a , A a ,T\ , T 2 , 
T 3 , T 4 ) to find the signer, the GM computes A t = A a e(E a , G)~ x °- and finds the 
corresponding entry % in the table of stored Join transcripts. The GM returns i 
and a non-interactive zero-knowledge proof g of knowledge of x' a so that O a = 
e(G,G) x “ and A a /Ai = e(E a , G) x ' a (see [H] for this proof). 

Reveal and Trace: Given the Join transcript of user i, the GM recovers the 
tracing trapdoor trace* = x Given tracer and a message-signature pair, a des- 
ignated party recovers 7\ and T 2 and checks if T\ = Y%*. If the equation holds, 
the tracer concludes that user i has produced the signature. 

Claim and Claim- Verify: Given a message-signature pair, a user i can claim 
that he is the signer by recovering X 3 and T 4 and producing a non-interactive 
proof of knowledge of the discrete-log of I3 base X 4 . Any party can run Claim- 
Verify by verifying the signature and the proof. 

Security. The security of T S is stated in Theorem HI The proof of this theorem 
uses techniques similar to those in [TS] and arguments similar to the proofs for 
our group signature schemes. 

Theorem 8. In the random oracle model, TS provides (i) security against 
misidentification attacks based on the q-SDH and the DDH assumptions, where 
q is the upper bound of the group size; (ii) security against anonymity attacks 
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based on the DBDH and DDH assumptions; (Hi) security against framing attacks 
based on the DL assumption. 


6 Efficiency 

The sizes of signatures and keys in our schemes are much shorter than those used 
in the Strong-RSA-based schemes at a similar level of security. This difference 
grows when higher level of security is required. In this section, we compare sizes 
in our new group signature schemes with those in ACJTOO scheme. We assume 
that our scheme is implemented using an elliptic curve or hyperelliptic curve 
over a finite field, p is a 170-bit prime, Gi is a subgroup of an elliptic curve 
group or a Jacobian of a hyperelliptic curve over a finite field of order p. G m is a 
subgroup of a finite field of size approximately 2 1024 . A possible choice for these 
parameters can be found in [5], where Gi is derived from the curve E/GF( 3‘) 
defined by y 2 = x 3 — x + 1. We assume that system parameters in ACJTOO 
scheme are e = 1.1, l p = 512, k = 160, Ai = 838, A 2 = 600, 71 = 1102 and 
72 = 840. We summarize the result in Table Q] 


Table 1 . Comparison of sizes (in Bytes) 


1 1 

| Signature gpk \ gsk 

ik 

ok | Security 

ACJTOO 

1087 

768 

370 

128 

128 

Weak Anonymity 

gsi 

597 

363 

192 

22 

44 

Anonymity 

gs2 

384 

235 

192 

22 

22 

Weak Anonymity 
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Abstract. For a finite group G to be used in the MOR public key cryp- 
tosystem. it is necessary that the discrete logarithm problem(DLP) over 
the inner automorphism group Inn(G) of G must be computationally 
hard to solve. In this paper, under the assumption that the special con- 
jugacy problem of G is easy, we show that the complexity of the MOR 
system over G is about log|G| times larger than that of DLP over G 
in a generic sense. We also introduce a group-theoretic method, called 
the group extension, to analyze the MOR cryptosystem. When G is con- 
sidered as a group extension of H by a simple abelian group, we show 
that DLP over Inn(G) can be ‘reduced’ to DLP over Inn (H). On the 
other hand, we show that the reduction from DLP over Inn(G) to DLP 
over G is also possible for some groups. For example, when G is a nilpo- 
tent group, we obtain such a reduction by the central commutator attack. 

Keywords: MOR cryptosystem, discrete logarithm problem, group ex- 
tension, central commutator attack. 


1 Introduction 

At Crypto 2001, Paeng et al. [8] proposed the MOR public key cryptosystem 
using finite non-abelian groups. For a group G to be used in the MOR public key 
cryptosystem, it is necessary that the discrete logarithm problem(DLP) over the 
inner automorphism group Inn(G) of G must be computationally hard to solve, 
and there must be an efficient way to represent group elements as products of 
the specified generators of G. Furthermore, we expect the security of the MOR 
system to be something ‘mor(e)’ than that of DLP over G. Also it should be 
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noted that the difficulty of DLP depends not only on the algebraic structure of 
the group, but also on how elements of the group are represented. 

Despite of many cryptographic advantages(see [8]) of the MOR cryptosystem, 
the groups proposed so far have turned out to be unsatisfactory (see [7MIT3]h 

In this paper, we are not trying to suggest new candidates for the groups 
G to be used in the MOR cryptosystem. We would rather intend to reveal the 
reasons why it is not easy to find good candidates for G. Thus, we hope that this 
paper helps searching for suitable groups for the MOR system. 

First, in Section 2, we compute the complexity of finding the secret keys of 
MOR system in a generic sense. Under the assumption that the special conju- 
gacy problem of G is easy, we show that the complexity of MOR system over G 
is about log |G| times larger than that of DLP over G in a generic sense. This 
result is somewhat unexpected, since our intuitive expectation for the generic 
complexity of MOR system is about \Z(G)\ times larger than that of DLP 
over G. 

Next, in Section 3, using the well-known theory of group extensions, we show 
that it is possible to ‘reduce’ the problem of finding the secret keys of MOR 
system over G to that of the MOR system over (smaller) subgroups H of G. Our 
method is a generalization of various attacks given in nunmu. 

In Section 4, we intend to find a reduction algorithm, which reduces MOR 
system over G to DLP over G. (If this reduction were efficient enough, MOR 
system would have less advantage in security than other public key cryptosystem 
based on DLP over G.) We show that this reduction is possible for the groups 
which are nilpotent or ‘nearly’ nilpotent. We call our reduction the central com- 
mutator attack and we note that this attack is generic. 

In this paper, we use the following standard notations : If iV is a normal 
subgroup of G and g e G, the order of g is denoted by \g\ and the image of g 
in G/N is denoted by g. We let Inn(g) be the inner automorphism of G induced 
by g, that is, 

Inn(ff)(a;) = g~^xg, (: x € G) 

and we let Inn(G') = {11111(5) | 9 G G} be the subgroup of inner automorphisms 
in Aut(G). We note that Inn(G) « G/Z(G), where 

Z{G) = {zeG\zg = gz for all g e G} 


is the center of G. 

2 MOR Cryptosystem 

2.1 Description of MOR Cryptosystem 

The MOR cryptosystem [5] is described as follows. 

- Bob’s Public key: (Inn(g(), Inn (5 s )) 

- Bob’s Secret key: An integer s(mod r/|), where g £ G/Z(G) 


On the Security of MOR Public Key Cryptosystem 389 


It should be noted that for a fixed generating set { 7 * | i € 1} of G, a public 
key (Inn(< 7 ), Inn(g s )) = (ip, ip s ) is described by the data {^(Ti)} and {^ s ( 7 i)}- 

Encryption 

1. Alice chooses a random integer r and computes (Inn(<ji s )) r = Imi(V/ sr ). 

2. Alice computes E = Inn(g sr )(M). 

3. Alice computes g = (Innf^j j r = lxm(g r ). 

4. Alice sends (E, g) to Bob. 

Decryption 

1. Bob computes g~ s = Inn(< 7 _sr ). 

2. Bob recovers M = g~ s (E). 

2.2 MOR Cryptosystem and Related Problems 

For simplicity, let us write DLP(G) for DLP over G. Thus DLP(Inn(G)) stands 
for DLP over the inner automorphism group Inn(G) of G. 

The security of MOR system is related with the following problems : 

- [Special Conjugacy Problem] : For a given p £ Inn(G), find h £ G such that 
Inn(/i) = ip. 

- [DLP(Inn(G))] : Given ip, ip s £ Inn(G) for some s £ Z, find s(mod |<^|). 

Throughout this paper, let us assume(agree(?)) that the special conjugacy 
problems over G are not hard to solve. (Otherwise, one can exploit the cryptosys- 
tem using the hardness of the special conjugacy problem over G.) Therefore, for 
given Inn(<ji), we may find g' £ G satisfying Inn(</) = Inn(</). It means that 
g' = gz for some z e Z(G). In this case, DLP(Inn(G)) can be restated as fol- 
lows : 


Find an integer s(mod |p|) for given g, g s z £ G, where z £ Z(G ), 


or 

Find an integer s(mod | r/ 1 ) for given g. g £ G/Z(G). 

It means that DLP(Inn(G)) is equivalent to DLP(G/Z(Gjj. 

In particular, if |^(G)| is sufficiently large, there is little possibility that g s z 
is contained in the cyclic subgroup (g) for a randomly chosen z £ Z{G). Hence, 
existing algorithms for solving DLP(G) do not seem to be directly applied to 
DLP(Inn(G)). On the contrary, if \Z(G)\ is too large, then Inn(G) becomes too 
small to be used for MOR system. Therefore, we conclude that the appropriate 
size of Z(G) is crucial in MOR system. 

2.3 Central Attack 

The crucial role of Z(G) gives rise to the following intrinsic attack against MOR 
system. 

Assume that \Z(G)\ = m is known. For given g and g s z for some s £ Z and 
z g Z(G), we get hi = g m and h? = ( g a z) m = (g m ) s ■ Now, solving DLP((g m }) 
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or DLP(G), we get s(mod which gives a partial information of the secret 
key s. Of course, g m may be the identity of G in the extreme case(for example, 
see |H1 p. 477]). 

2.4 Complexity of Generic Algorithm on MOR System 

Since middle of 90’s, a lot of works [Til [41 [51 15] have been done on generic al- 
gorithms for DLP and their lower bounds of complexity. Algorithms which do 
not exploit any particular property of representations of the group are called 
generic, and the baby-step giant-step algorithm is one of the generic algorithms 
for DLP. In generic algorithms for DLP, only group operations and equality tests 
are used. 

Let {7* | i £ 1} be a given generating set of G for MOR system, and a 
public key (cp, (p s ) be given by { and { Assuming that the special 
conjugacy problem over G is not difficult as before, we get g and g s z for some 
unknown z 6 Z(G). 

Let MuIq{ ■,■)> Inv G {-) and Equ G ( denote the group operation (multi- 
plication and inversion) oracles and the equality test oracle of G, respectively. 
Now, consider the factor group G/Z{G). The generic operations of G/Z(G) can 
be realized using those of G as follows. 

• Group operation oracle of G/Z{G ) : 


MuIg/z{g){9i-,92) = Mul G (gi,g 2 ), 
Inv G /z(G){9 ) = Inv G (g). 


• Equality test oracle of G/Z(G ) : 



(if 9W2 K H = H9i92 1 for a11 *e7), 
(otherwise) . 


One equality test in G/Z(G) requires at most (2|/| + 1) calls of Mul G , 1 call 
of Inv G and |/| calls of Equ G . Under the assumption that |/| = 0(log G | ) , we 
have the following result as a direct application of the Pohlig-Hellman algorithm 

in [TO]. 

Theorem 1. Let a public key of MOR system (Inn( 5 ), Inn(g s )) be given, and 
let |g] = rii=i pT> where Pi are distinct primes. Under the assumption that 
|/| = 0(log|G|) and that the special conjugacy problem over G is easy, the 
secret key s can be computed by 0(J]] ej(log |<7| + Pi) log |G|) group operations 
and equality tests of group elements. If a memory space for storing \ p \ group 
elements (where p is the largest prime factor of\g\) is available, the running time 
can be reduced to 0(^2 G(log |ff[ + \fpilogPi) log |G|). 

Proof. By the above discussion, one equality test between two elements of G/Z(G) 
requires 0(log |G|) group operations and equality tests of elements of G. The sec- 
ond assertion follows directly from [10] . □ 
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Thus, in a generic sense, the complexity of computing the secret key of MOR 
system is about log |G| times larger than that of solving DLP(G). 

This result is somewhat unexpected, since our intuitive expectation for the 
generic complexity of MOR system is about \Z(G)\ times larger than that of 
DLP over G. (If the equality test oracle of G/Z(G) were; “check if g\ = g 2 z for 
each z G Z(G) n , then we would obtain the result matching our intuition. So, the 
point is that one equality test between two elements of G/Z(G) requires only 
0(log |G|) group operations and equality tests of elements of G.) 


3 Group Extensions and MOR Cryptosystem 

Since it does not seem easy to find a good candidate for MOR cryptosystem 
from the list of well-known finite groups, we consider an inductive argument as 
follows. Suppose that the group G is good for MOR system, and suppose that G 
has the smallest order among good candidates. Then we think of G as a group 
extension of a maximal normal subgroup H of G, which is not suitable for MOR 
system by the hypothesis. 

In this section, generalizing the various ideas of EMEU, we show that it is 
possible to w-reduce(see the definition below) DLP(Inn(G)) to DLP(Inn(ff)), 
where H is a maximal normal subgroup of G. 

Definition 2. Given ip, tp s G Inn(G) with a secret key s (mod | ) , if we can com- 
pute ip, ip s for some ip G Inn(if), we say DLP(Inn(G)) can be w-reduced (weakly- 
reduced) to DLP (Inn (if)). In this case, note that we can recover s(mod |'0|), 
provided DLP(Inn(fJ)) is not hard to solve. (Of course, \ip\ may be 1 in the 
extreme case.) 

Although the theory of group extension(see, for example, [2j §15.1] or [TO] 
§2.7]) is quite standard and well-known, we briefly sketch the proofs for some 
results of group extensions to prepare for our proof of Theorem [TO] 

3.1 Group Extensions 

Definition 3. For given two groups H and F, if H <G and G/H = F, then we 
call G a group extension of H by F. 

Theorem 4. (See \MIM-) If G is a group extension of H by F, there exist func- 
tions T : F — > Aut (H) and f : F x F —> H satisfying the following conditions : 

(1) T(r) o T(a) = Inn (/(<j, r)) o T(ar), for <t,t G F, 

(2) f((T, Tp ) /(t, p) = /(err, p) T(p)(f(a, t)), for a,T,p& F, 

(3) /(1,1) = 1. 

Proof Let t : F — > G give rise to a bijection between F and a complete set of 
coset representatives of H in G such that f(l) — 1 (t is called a transversal). 
Next, we define two functions T : F — > Aut (H) and / : F X F — > H by 
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(a) T(a)(h) = fycr)- 1 /^), for a £ F, h £ H, 

(b) f(a,r) = t(aT)~ 1 t(a)t(T), for cr, t e F. 

Then, T and / satisfy the conditions (l)-(3). □ 

Remark 5. If T and / satisfy the conditions (l)-(3) of Theorem 01 then we 
call f a factor set belonging to T. If a factor set / is obtained from G as (a) and 
(b) in the proof of Theorem |U then we call f a factor set associated with the 
extension G. 

Theorem 6. (See i Let f : F x F — > H be a factor set belonging to 

T : F — > Aut(H) . Then there exists a group G which is a group extension of H 
by F such that f is a factor set associated with G. 

Proof. Put G = {t(a)a \ a £ F, a £ H} and define a binary operation * on G 
by 

[t(a)a]*[t(T)b] = t(aT)f(a,T)T(T)(a)b, (<t,t £ F, a,b£H). 

Then, G becomes a group extension of H by F. Moreover, t(o) 1 is actually 
a transversal and (T, /) satisfies the conditions (a) and (b) in the proof of 
Theorem ED □ 

Corollary 7. (See fMTffj.) The group extension G is uniquely determined by T 
and f. In this case, we denote G = [H, F, T, /]. 

We note that semi-direct products are group extensions with the trivial factor 
sets. In it is shown that DLP over inner automorphism groups of semi- 

direct products can be reduced to DLP over inner automorphism groups of 
individual groups. For group extensions, a similar result can be derived. 

Theorem 8. Assume the group extension data G = [H, F, T, f] is known. If F 
is non-abelian, then DLP(Inn(G)) can be w-reduced to DLP (Inn (T)). 

Proof. Let ip = Inn(g) and g = t(a)a, where a £ F, a £ H. For any x = t(r)b £ 
G, we have 

p{x) = [(f(a)a)- 1 ] * [t(r)6] * [t(a)a] 

= [t(<7 _1 )d] * [ t(r)b \ * [t(o-)o], (where T(a)(d) = f(a~ 1 ,a)~ 1 a~ 1 ) 

= [t(a- 1 T)f(a- 1 ,T)T(r)(d)b]*[t(a)a] 

= t{a~\a) f(a-\a) ■ T(a)(f(a~\T) T(r)(d) b ) ■ a. 

Similarly there exists A £ H such that (p s (x ) = t(o~ s To s )A. Let F = Inn(cr). 
Then, the problem of finding s from given <p, ip s £ Inn(G) can be w-reduced to 
that of finding s from F, F s £ Inn(F) . □ 

Theorem |5] implies that the smaller order cr £ F/Z(F) has, the less infor- 
mation about s is exposed. Therefore, it is reasonable to take F to be abelian. 
The next theorem is useful when we investigate group extensions by finite cyclic 
groups. 
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Theorem 9. (See JH § 15.3].) If G is a group extension of H by Z n , then G is 
uniquely determined by x £ Aut (H) and a G H satisfying the following condi- 
tions : 

(1) x n — Inn(a) 6 Inn(if), 

(2) X {a) = a. 

Proof. Write Z n = {0, 1 ,n — 1}. We choose a coset representative 1 of 1, 

and define a transversal t : Z n — * G by t(i) = 1 for 0 < i < n — 1 . Then, 
T = a for some a G H. Therefore x '■= Inn(l)| ff G Aut(It). Then x and 
a satisfy conditions (1) and (2). Conversely, if x and a are given, we define 
T : Z n -> Aut (H) and / : Z n x Z n -» H by 

T(i) = X\ 

Then T and / satisfy the conditions (l)-(3) of Theorem 0] □ 


(0 < i < n - 1) 
if i + j <n, 
if i + j >n. 


3.2 MOR System and Group Extensions 

Let G be given by a group extension of H by F. The case, for which F is non- 
abelian, is not desirable since DLP(Inn(G)) can be w-reduced to DLP(Inn(F)) 
by Theorem |8l 

Furthermore, since every finite group has a composition series, we may regard 
G as a group extended by finite simple groups for finitely many times. Therefore, 
in this section, we analyze the case when F = Z p for some prime p. Now we have 
the main result of the present section. 

Theorem 10. If the group extension data G = [H, Z P ,T, f] is known, then 
DLP(Inn(G)) can be w-reduced to DLP(Inn(F)). 

Proof. Let G = [H, Z p ,T, /]. Then, by Theorem [5] there exist x G Aut (H) and 
a G H satisfying the following conditions : 

T(i) = x\ 

/<«) = {' 

X p = Inn(a) 6 Inn(H) . 

Now, we compute Z(G). If t(i)a G Z(G), then for all j G Z p and b G H, we 
have 

[t(i)a\ * [t(j)b] = [ t(j)b \ * [f(z)a]. 

Therefore, 

'*{* + J) /(hi) X j ( a ) b = + i f(j, i) x\b) a 


(0 <i<p), 
if i + j <p, 
if i + j >p, 
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and hence this implies xH a ) = a and b = a 1 X l (b) a - Note that this is equivalent 
to xi a ) = a an d X* = Inn(a _1 ). Hence we conclude that 

Z{G) = { t(i)a | x(a) = a, \ i = Mo" 1 )}' 

Since \ p = Inn (a) £ Inn (id) and p is prime, we note that the order of x in 
Out (id) = Aut (id) /Inn(id) is 1 or p. 

Case 1. |x| = 1. 

We prove this case by showing that there is a computable isomorphism be- 
tween G/Z(G ) and H/Z(H). If |x| = 1, then x = Inn(/t) for some h £ id. 
Since \ l = Inn(ft*) = Inn(a _1 ), there exists z* £ Z(H) such that h l = a~ 1 z i 
(i.e., h l a £ Z(H)). Then h commutes with a and thus x( a ) = Inn(/i)(o) = a. 
Therefore, 

Z(G) = { t(i)a | h i a£Z(H)} 

and we have 

\Z(G)\ > \Z(H)\. 

Next, we find an isomorphism between G/Z(G) and H/Z(H). Since x p = 
bin (/A) = Inn(a), we have a = h p z for some 2 £ Z(H). We define O' : G — » 
H/Z{H) by 

</>(/.(/)«) = /do, (a£H,i£ Z p ). 

Then we can show the followings. 

1. S' is a group homomorphism: 

^([t(i)a] * [ t(j)b ]) = (t(i+j) x j (a) b) 

{ hi+j ( a ) b = hi+j b,-j ahi b= h l a h^b, if i + j < p 

h i+ l- p hP z x j {a)b = zh 1 a hi b = hla hib, if i + j > p 

= tf(t(i)«*)tf(W)- 

2. is surjective : For g £ H/Z(H), where g £ H, we have 
^{t{i)h~‘ l g) = htif-tg = g. 

3. Ker S' = Z(G ) : t(i)a £ Ker S' <s> h*a £ Z(H) <s> t(i)a £ Z{G). 

Hence, by the first isomorphism theorem, we have 

¥ : G/Z(G) H/Z(H). 

Note that S' is computable since h can be derived from x = Inn(/i). 

Case 2. |x| = P- 

If Ixl = P, i should be 0 in order that the equation x' = Inn(a _1 ) holds. 
Moreover, since x°(^) = b= aba~ x for all b £ id, a must be contained in Z(H). 
Therefore, we have 


Z(G) = {i(0)a | x(a) = a, a £ Z(H)} < Z{H). 
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For given Inn(f(i)a) and Inn ((t(i)a) s ), under the assumption that the special 
conjugacy problem of G is easy, we can find t(j)c and t(l)d such that Inn(f (i)a) = 
Inn(f(j)c) and Inn ((f(*)a) s ) = Inn(f(7)d). Then we must have i = j (modp) and 
c = az for some z G Z(H) with x( z ) = Similarly, we get is = l (mod p) . 
Consequently, we obtain s = r' (mod p) and thus we may put s = pr + r' for 
some integer r. Since 


V- times 

mar =ma]*mZ\*---*ma] 

(p-l) ; times 

=[t(i)a] * [ t(i)a } *■■■* [i(i)a] * [t(2i) f(i, i) T(i)(a ) a] 

(p-2)-times 

=ma]*"-*ma] * [t(3i) /(*, 2-i) T(2i) (a) f(i, i) T(i) (a) a) 
i = o 

= t(0) 
v - 1 

where <I> = n /(*. y) T(ij)(a), we have 
j—o 


Inn (( ) = lnn(t(0) 


and 

Inn (( t(i)a) s ) o Inn ^( t(i)a)~ r ^ = Inn (( t{i)a) pr ) = Inn (t(0) <£ r ) . 

We may consider lnn(f(0) &)\h and Inn (t(0) <I> r ) \ H as elements of Inn(il), 
and we conclude that DLP(Inn(G)) is w-reduced to DLP(Inn(H)). □ 

Example 11. Let A be the graph automorphism of order 2 of SL n (q)(see [12] 
§ 10]). The group extension G = [SL„(g r ), Z 2 , A, 1] belongs to Case 2. In this case, 
the order of Z(G) is the same as that of SL n (q) . 

Example 12. A metacyclic group(for example, see [3] p. 99]) is a semi-direct 
product and belongs to Case 2. In this case, the order of the center of the group 
decreases. 


In Case 1, since we can find a computable isomorphism 
&:G/Z(G) -^H/Z(H), 

we see that DLP(Inn(G)) can be completely reduced to DLP(Inn(if)) in this 


case. 
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Example 13. (See [8].) Let G = SL 2 (p) Xg Z p , where 

9 = Inno 0! : Z p -► Aut(SL 2 (p)), 

and 9i is an isomorphism from Z p to (a), a £ SL 2 (p). Then 

Z(G) = { t(i)a | h*a = ±I, a£ SL 2 (p)}. 

Note that \Z(G)\ > \Z(H)\ and hence this example belongs to Case 1. There- 
fore, we have 

G/Z(G) S SL 2 (p)/Z(SL 2 (p)) S PSL 2 (p). 

Remark 14. Moreover, all semi-direct products using inner automorphisms are 
of Case 1. This is the reason why the authors of 0H] search for outer automor- 
phisms. 

Remark 15. As in [8j|9], even when the message space is restricted to { t,(Q)h \ 
h £ H }, a similar reduction is possible and we omit the proof. 

Remark 16. Since we can only w-reduce DLP(Inn(G)) to DLP(Inn(R)), we 
may not succeed in recovering full information about the secret keys. However, 
we note that there are many choices of maximal normal subgroups H in G. Thus, 
we may conclude that the group extension data G = [H. Z p , T, /] should not be 
easily obtained in order to have a secure MOR system. This should be kept in 
mind when we search for suitable groups for MOR system. 

4 Central Commutator Attack 

As we have mentioned in Section [5J DLP(Inn(G)), which is the underlying prob- 
lem of MOR system, depends a lot on the center Z(G) of G. We are thus naturally 
led to consider the lower central series of G. Especially, we are interested in the 
nilpotent groups of which the length of lower central series are finite. 

In this section, we show that there is a reduction algorithm for MOR system 
on a nilpotent group. 

4.1 Central Commutator Attack 

As before, for g £ G, we assume a public key (Inn(g), Inn (5 s )) = ( <p,(p s ) is 
given. 

Lemma 17. Suppose we can find h,z £ G such thatz = y>(/i -1 )/z = g~ 1 h~ 1 gh f= 
1 and <p(z~ 1 )z = g~ 1 z~ 1 gz = 1, then z s can he computed from ip s . 

Proof. Observe the following computation : 

ip s {h~ x )h = g~ s h~ 1 g s h = g~ s (h~ 1 gh) s = g~ s (gz) s = z s . □ 
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Thus, if we can find such h and z and can solve DLP((z)) from z and z s , 
we get ,s(mod \z\). To find such h and z, assume G is nilpotent and consider the 
lower central series of G ; 

G = G° > G 1 > ■ ■ ■ > G k ~ l > G k = (1), 

where G l = [G, G* -1 ]. We have k > 2 because we are assuming G is non-abelian. 
Since G k ~ 2 /<Z{G) and G fc_1 < Z(G), there exists h £ G k ~ 2 \Z{G). Letting 
z = g~ 1 h~ 1 gh £ G fe_1 , z is contained in G fc_1 < Z(G) and thus z commutes with 
g. This technique is called the central commutator attack , since z and z s £ Z(G) 
are central commutators. 

However, when z is the identity of G, we do not get any information about 
s, and the condition z f= 1 is not guaranteed here. The next algorithm settles 
this problem and it can be applied to any nilpotent group. 

Lemma 18. Let G be a nilpotent group of nilpotency (k — 1) with k > 2. Then 
the Algorithm-1 below outputs z and z s with z f= 1 (and n in the Algorithm-1 
satisfies n <k). 


Algorithm-1 

Input: 

c p = Inn(p) and ip s = Inn(p s ) such that ^ ^ 1. 

Step 1: 

Define cr(x) := <p(x~ 1 )x = g~ l x _1 gx and 
choose xo such that cr(a:o) ^ 1. 

Step 2: 

For m £ N, define x m ■= a(x m -i) and 

let n be the smallest integer such that x n = 1. 

Step 3: 

Put h = x n - 2, z = x n -i and compute z s = ip s (h~ 1 )h. 

Output: 

z and z s with z ^ 1. 


Proof. For Inn (g) to be used for an encryption, there should exist Xo which is not 
trivially encrypted, i.e., ip(x o) f=x o and g~ l Xo g xq _ 1 f= 1. SinceG is a nilpotent 
group of nilpotency (k — 1), we have the following lower central series of G ; 

G = G° > G 1 > ■■■ > G k -' > G k = (T), 

where G l = [G, G 1-1 ]. Define cr and x rn as in the Algorithm-1. We note that 
x rn £ G m for rri = 1, ... ,k and thus xj. = 1. Therefore we see that n < k. Since 
n is the smallest integer such that x n = 1, we have z = x n -\ /= 1. Now, if we 
put h = x n - 2 , then h and z satisfy the conditions of Lemma ITT1 and thus we get 
ip s (h~ 1 )h= z s . □ 

Thus by solving DLP((z}), one can compute some partial information of the 
secret, i.e., s(mod z |) . Moreover, we will show that one can recover s completely, 
if DLP over prime order subgroups of G are easy. 

Let m — \g\ = 11,-1 Pi' be the order of g in G/Z(G), where p, are distinct 
primes. Then the following algorithm is nothing but an application of the Pohlig- 
Hellman algorithm [10] to MOR system. 
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• Step A : For a fixed i, compute .s(inodp;-) for j = 1, . . . , e*, inductively. 

• Step B : Compute s(modpj ei ) for each i= 1 ,... ,k. 

• Step C: Using the Chinese remainder theorem, compute s (mod to). 

We note that only the Step A is essential here : Fix a prime factor p of to, 
and let e be the exponent of p in to. Let 

e— 1 

s(modp e ) = Sjp- 7 , (0 < Sj <p — 1). 
j = o 

First, compute 

:= (Inn {g)) m/p = lim(g m/p ) 

and 

fo := (Inn (g s )) m/p = Inn (g m/p ) s = hm(g m/p y° = ip s °. 

Since g m ^ p is not contained in Z(G), we have V’(7i _1 )7i f= 1 for some*, where 
{7i | i £ 1} is a given generating set of G. Applying the Algorithm-1 to ip and 
if) o, we get h, z and z s ° such that 

i = (g-^h-^g^h and (« r mlv )z~\g mlv )z = 1. 

Observe that \z\ = p. Solving DLP((^)), we obtain s 0 . Now, assume that we 
have obtained so, . . . , sr-i for some i < e. Next, we compute 

ft :=(Inn(5 s ) ) m/pt+1 

=(Inn (gS-Zj=o^))m/ P e+1 

= Inn (g m ' p y*. 

Again applying the Algorithm-1 to ij) and '(/y , and solving DLP((^)), we obtain 
S(. By induction we can compute s(modp e ). In summary, we have the following 
result. 

Theorem 19. Let G be a finite nilpotent group. For given Inn(g') and Inn(<ji s ), 
by solving DLP over prime order subgroups of G, one can recover s(mod\g\) 
completely. In other words, DLP(Inn(G)) can be completely reduced to DLP over 
prime order subgroups of G. 

We mention here that the central commutator attack is generic in the sense 
that the algorithm does not use particular property of representations of the 
group but uses only group operations and equality tests of group elements. 

Even when G is not nilpotent, the Algorithm-1 can be applied. First, observe 
the following. 

Lemma 20. For x £ G define t x : G — > G by 

T x (y) = x~ l y~ x xy, {yeG). 

Then G/Z{G) has nontrivial center if and only if there exists x £ G\Z(G) such 
that t x (G) C Z(G). 
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Proof. Element ary (see, for example, [U p. 70]). 

When the center of G/Z(G) is non-trivial, there exists x £ G such that 
[a:, G] C Z{G). Thus, given = Inn(<ji), we have r x (g) = x - V(:r) e Z{G) and 
x G Z(G). Now we see that Algorithm-1 works. Therefore, we might say 
that Algorithm-1 is valid if G is ‘nearly’ nilpotent. 

When the center of G/Z{G) is trivial, G has the trivial upper central series 
and perhaps is secure against the central commutator attack. But we expect this 
kind of groups would be ‘similar’ to simple groups or semi-simple linear groups 
which are usually not suitable for MOR system. 


5 Conclusion 

The security of the MOR cryptosystem using a group G is based on the hardness 
of DLP(Inn(G)) and is related with the size of Z(G). In a generic sense, the 
complexity of DLP(Inn(G)) is about log G times larger than that of DLP(G), 
since Pohlig-Hellman or the baby-step giant-step algorithm can be applied to 
MOR system, provided the special conjugacy problem of G is easy. 

Since every finite group G has a composition series, we may regard G as a 
group extended by finite simple groups for finitely many times. This leads us to 
analyze a group extension G of H by Z p for some prime p, and it is shown that 
DLP(Inn(G)) can be w-reduced to DLP(Inn(H)). 

We note that there are many choices of maximal normal subgroups H in G. 
Thus, we may conclude that the group extension data G = [H,Z P ,T, f] should 
not be easily obtained in order to have a secure MOR system. This should be 
kept in mind when we search for suitable groups for MOR system. 

We also analyzed MOR systems on finite nilpotent groups. If G is nilpo- 
tent, or Z(G/Z(G)) f= 1, using central commutator attacks, it is shown that 
DLP(Inn(G)) can be completely reduced to DLP(G). 

Finally, it should be noted again that MOR system and DLP highly depend 
on the representations (or presentations) of groups. 
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Abstract. Recently, Augot and Finiasz presented a coding theoretic 
public key cryptosystem that suggests a new approach for designing such 
systems based on the Polynomial Reconstruction Problem. Their cryp- 
tosystem is an instantiation of this approach under a specific choice of 
parameters which, given the state of the art of coding theory, we show 
in this work to be sub-optimal. Coron showed how to attack the Augot 
and Finiasz cryptosystem. A question left open is whether the general 
approach suggested by the cryptosystem works or not. In this work, we 
show that the general approach (rather than only the instantiation) is 
broken as well. Our attack employs the recent powerful list-decoding 
mechanisms. 


1 Introduction 

Recently, in Eurocrypt 2003 |AF03j . Augot and Finiasz presented a public-key 
cryptosystem that was based on the Polynomial Reconstruction problem (PR). 
This scheme suggests a general approach for designing such cryptosystems; their 
cryptosystem is an instantiation of this approach based on a specific choice of 
parameters. 

Let us first review PR, which is a curve-fitting problem that has been studied 
extensively especially in the coding theoretic setting, where it corresponds to the 
Decoding Problem of Reed-Solomon Codes. 

Definition 1 (Polynomial Reconstruction (PR)). Given a set of points 
over a finite field {{zi,yi)}™ = v and parameters [n,k,w\, recover all polynomials 
p of degree less than k such that p(zi) f=yi for at most w distinct indexes 
% € { 1 , . . 

Regarding the solvability of PR, we remark that unique solution can only 
be guaranteed when w < (the error-correction bound of Reed-Solomon 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 3329, pp. 401-046] 2004. 

© Springer- Verlag Berlin Heidelberg 2004 


402 A. Kiayias and M. Yung 


Codes). For such parameter choices, the Berlekamp- Welch Algorithm |BW86| 
can be used to recover the solution in polynomial-time. When the number of 
errors w exceeds this bound, unique solution is not necessarily guaranteed. In 
this range, a decoding algorithm may output a list of polynomials that satisfy the 
constraints. This is called list-decoding and recently some breakthrough results 
have been achieved in this field. The most powerful list-decoding algorithm is the 
one by Guruswami and Sudan, |GS98j . The algorithm will work for any number 
of errors such that w < n — ij{k— 1 )n. For choice of parameters beyond the 
Guruswami-Sudan solvability bound, no known efficient algorithm exists that 
solves PR (and |GS98j gives some indication why such an algorithm is not likely 
to be found). 


public-key: 


Hard PR 
Instance 


secret-key: 
the error locations 


ENCRYPTION 

f random coefficient '; 


plaintext 

( Apply Reed-Solomon'l 

l Decoding ) 


ret key ) 

TS__J 


Fig. 1. The Augot and Finiasz general approach for designing a pk-cryptosystem using 
the hardness of RS decoding 


Augot and Finiasz’s general approach (see figure [lj) is to use a PR instance 
which is hard to solve (i.e., a highly noisy instance) as a public key, and to en- 
crypt a message by scaling the given public key (i.e., multiplying the polynomial 
values by a scalar) and adding to the scaled instance the message which is repre- 
sented as a slightly lower degree second PR instance which is solvable, yielding 
a PR instance representing the ciphertext. The receiver who knows the noise 
locations in the public key can recover the message. The approach allows key 
sizes that are much smaller than the traditional coding theoretic based public- 
key systems (i.e., the McEliece cryptosystem |McE78] b Further, direct use of the 
above mentioned decoding and list-decoding methods do not apply to breaking 
the cryptosystem (directly). To implement the approach of figure [Done needs to 
specify: (i) the structure of the public-key, (ii) the structure of the error-vector, 
and in accordance (iii) the decoding method employed in decryption. 

What we noticed is that while the public-key structure was chosen to be 
an unsolvable PR instance, the choice of the error-vector and the associated 
decoding method was sub-optimal considering the state-of-the-art of Coding 
Theory. The scheme was in fact, based on unique decoding (and not list decoding 
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techniques) and did not consider probabilistic analysis to maximize the allowed 
entropy of the error- vector. 

The scheme of |AF03] was recently broken by Coron |Cor03al|Cor03c| (with- 
out affecting the solvability of PR). The elegant attack presented in |Cor03c] is in 
fact a ciphertext-only attack that is built on the Berlekamp- Welch method and 
recovers the message, given knowledge only of the public-key and a ciphertext. 
A further modification of the scheme, using extension fields but essentially the 
same system, was suggested recently |AFL03] and was shown by Coron |Cor03b| 
to be vulnerable to essentially the same attack. 

Coding Theoretic Motivation. The Augot-Finiasz cryptosystem employed 
unique decoding techniques rather than list-decoding techniques (assuming that 
unique decoding is what is needed for a correct cryptosystem — an assumption 
we refute herein). Moreover, they consider only worst-case analysis in the se- 
lection of the code parameters. Thus, their cryptosystem is sub-optimal in the 
above respects given the general approach outlined above. 

This leaves open the question of whether this general approach works in 
principle, i.e., when one uses the optimal coding theoretic techniques and prob- 
abilistic analysis for the parameter selection. 

Our Results: In this work we investigate the above question. In particular, 
we maximize the rate of the error vector used during encryption and choose 
state-of-the-art list-decoding techniques to implement the Reed-Solomon de- 
coding step for decryption. Regarding the optimization (maximization) of the 
error-rate we make two key observations (1) the system of |AF03| employs a 
worst-case approach in selecting this parameter; a probabilistic approach (that 
we perform in this work) allows higher values. (2) the system of |AF03] employs 
Berlekamp- Welch RS-decoding for the decryption operation. We emphasize that 
more powerful decoding techniques can be employed that allow larger values for 
the error-rate parameter. Our methodology is to use an extended set of tools 
both for design and analysis in order to get the best possible instantiations of 
the general approach. The tools include “list decoding” rather than unique de- 
coding techniques (which we show to be still good for decryption, since decoding 
to a unique value is assured with extremely high probability over a large enough 
field, even when ambiguous decoding is allowed, cf. Lemma ^). 

We develop our presentation as a ping-pong game between a cryptosystems 
designer and a cryptanalyst. To avoid any misunderstanding our goal is not to 
design a new cryptosystem, but rather using the design and cryptanalysis steps 
as a methodology for exploring the general approach. 

First Step. Regarding our key-observation (1) we employ the tails of the hyper- 
geometric distribution to show that the original scheme allowed too few errors in 
the error-vector to be used by the message encryption process. Thus the error- 
rate can be increased high enough to aid the designer to achieve instances of 
the cryptosystem where Coron’s analysis does not work. But, nevertheless we 
provide an alternative probabilistic analysis showing that the original attack of 
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Coron would work almost always even in this modified (more noisy) version, 
thus aiding the cryptanalyst. 

Second Step. Combining our key-observations (1) and (2) above, we discover 
the optimal setting for the sender error-parameter (“optimal” under the assump- 
tion that the Guruswami-Sudan list-decoding algorithm [GS98| represents the 
best possible decoding algorithm against Polynomial Reconstruction). We show 
that the optimal parameter setting, helps the designer and in this case Coron’s 
attack fails. To answer our question about the limit of the approach, we then 
present a new attack that is based on the Sudan and Guruswami-Sudan algo- 
rithms |Sud971IUS98j . Our attack, with overwhelming probability, breaks even 
the optimal parameter setting. This means that the general approach, outlined 
in figure [TJ taken by Augot and Finiasz (rather than merely their non-optimal 
instantiation) breaks. 

We believe that our results demonstrate how design and analysis of Cod- 
ing theory based cryptography, must employ probabilistic methods and state of 
the art decoding techniques. Furthermore, our results and the attack of Coron 
demonstrate that PR-based cryptosystems that lack formal proofs of security 
by concrete reduction arguments, even when they seem to be related to PR, 
are potentially susceptible to coding theoretic attacks that do not imply any 
weakness in the PR problem itself. Note that, the private-key cryptosystem 
based on PR suggested by the authors in |KY02j was shown to be semanti- 
cally secure under an intractability decisional assumption that bears upon the 
average-case PR (for choices of the parameters beyond the Guruswami-Sudan 
solvability bound). This cryptosystem (as well as the other cryptographic prim- 
itives in |KY02j ) are not affected by the techniques of the present paper and of 
Coron’s |Cor03allCor03bllUor03c] and breaking these designs seems to require 
significant advances in RS decodability. 

Due to space constraints proofs are omitted from the present abstract; the 
full- version with all details is available in [KY04j . 

2 Background: The Recent Polynomial-Based 
Public-Key Cryptosystem 

We review the recent developments, while setting up the necessary notations 
and interesting points regarding our investigation. 


2.1 The Cryptosystem of [AF03] 

The cryptosystem of |AF03] can be described in high level as follows: 

1. The public-key is a PR-instance of parameters [ri.k + 1, W] for which (i) the 
hidden polynomial p is monic; (ii) solving the instance is considered hard. 
The public-key is a sequence of values in (F x F)” (while the locations of 
the error points is the secret key). 
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2. Encryption operates by first transposing (i.e., scaling the polynomial of) 
the public-key using a random value a e IF (the encryption coefficient), and 
then adding to the transposed public-key the message (evaluated as a second 
polynomial represented as pairs of points using the same first coordinates as 
the points of the public key PR instance, with no errors), and finally adding 
some additional w errors. (In other words, the message is embedded in a 
second PR instance with w errors and added to the transposed public key) . 
It follows that a ciphertext is a sequence of values in (F x F)". 

3. Decryption removes the points that correspond to public-key errors, i.e., W 
points of the ciphertext. Decryption relies on the following two facts: (i) the 
remaining n — W points can be decoded into a polynomial //; (ii) due to 
the fact that the message polynomial is selected to be of degree less than the 
degree of the monic polynomial p hidden in the public-key, it follows that 
the recovery of p* implies the recovery of the encryption coefficient a. The 
message polynomial can be recovered as p m sg(x) = p*{x) — otp(x). 

We note that the points over which the polynomials are evaluated in a PR 
instance can be publicly known (thus the public-key and the ciphertext can be 
considered to be of size only |F|"). 

In more detail, let zi , . . . , z n £ F be arbitrary distinct elements of the under- 
lying field, where n £ IN is a security parameter. The public-key of the system 
is a PR-instance that is generated as follows: first a random tuple {Ei, . . . , E n ) 
is selected that has exactly W non-zero randomly selected elements from F. 
Second, a random polynomial p of degree less than k is selected. The public-key 
is set to pk := {{zi, yi)}" =1 where y* = p(zt ) -f Ei + zf for % = 1, . . . , n. 

Remark. Observe that {(zj,yj — is a random PR-instance with param- 

eters n, k, W. 

The encryption operation is defined with domain F fc and general range the 
set (F x F)". The message msg is encoded as a polynomial of degree less than 
k, denoted by p mS g(x)', a random tuple (ei, . . . , e n ) is selected so that it has 
exactly w non-zero randomly selected field elements; a random element a € F 
is selected as well. The ciphertext that corresponds to msg is the sequence of 
pairs {(zi, y()}£=i defined as follows y( = ay* +p m sg(zi) + e*, for i = 1, . . . , n. 

So far, the above represents a general approach. The exact choice of param- 
eters (as a function of n, say) gives the specific system of |AF03j . 

The decryption operates as follows: let I C n} be such that |/| = 

n — W and for all i £ I it holds that £) = 0 (from the selection of the public- 
key). Observe now that the sequence of pairs C = {(^, y')} ie / can be seen as a 
PR-instance with parameters [n — W,k + l,w\. Now suppose that, 

n — W — h — 1 

Condition # 1 : w < =$■ n>2w + W + k+ \ 


This condition implies that the PR-instance has a unique solution that can 
be recovered by the unique decoding technique of Berlekamp- Welch algorithm. 
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Given such solution p* ( x ) it follows that the leading coefficient of p* will be equal 
to a (by construction, we have that the polynomial hidden into the public-key 
is monic and of degree k while the degree of the message polynomial is at most 
k — 1). Then, the transmitted message can be recovered as follows p rn .sg (x) = 
p*(x) — a(x k + p(a:)). 

A second condition is that W should be large, beyond the known bounds of 
list-decoding, to assure that a third party cannot simply get the error locations 
of the public key (and thus decrypt all ciphertexts). This condition is the base 
of the presumed security of the scheme. 

2.2 A Cryptanalytic Framework 

The Cryptanalytic problem that is the basic building block for mounting a 
ciphertext-only attack on the Public-Key Cryptosystem of [AF03j as described 
above is defined as follows: 

Definition 2 Ciphertext-Only Attack Problem (CAP). Given two 
sequences of tuples Xi := {{zi,yi)}™ =1 and X 2 := {{zi,y'f)Yi l =1 and parameters 
n, k, w, W that satisfy the following conditions 

i. w< n-w-k-x andW >n- y/n(k- 1). 

ii. {( Zi,yi — z k )}™ =1 is a random PR-instance with parameters [n, k, W]. 

Hi. 3agF such that {{zi, y[— ayj)}” =1 is a random PR-instance with parameters 
[n,k,w]. 


Goal. Find a list of values of polynomial-length that contains the value a. 

Any algorithm that solves CAP in polynomial-time can be turned into a 
ciphertext-only attack against the cryptosystem of |AF03j . as the following 
proposition reveals. 

Proposition 1 . Let A be an algorithm that solves CAP in polynomial-time. 
Then any message encrypted in the cryptosystem of ]AF03( can be decrypted 
without knowledge of the secret-key in polynomial-time in the security parameter. 

2.3 Coron’s Attack 

In |Cor03c] , Coron presented an elegant ciphertext-only attack against the cryp- 
tosystem of |AF03j . We explain the attack briefly below and we show that in 
fact it can be seen as an algorithm to solve CAP (in fact our formulation of CAP 
above is motivated by the original attack and by further extensions of this idea 
in the sequel). 

Let X 1: X 2 be an instance of CAP, with X\ = {(^,yi)}" = 1 X 2 = {(zi,y[)}f =1 
and parameters k, w, W, n. Due to condition in of definition [5] it follows that there 
exist j) £ F[i] of degree less than k and a £ F, so that p(zf) f=y' l — at/, for at 
most w indexes i. 

The attack modifies the Berlekamp- Welch algorithm: Let E(x) be a monic 
polynomial of degree w such that E(zi) = 0 for exactly those indexes i for which 
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p(z { ) f=y\ - ayi . The existence of this polynomial is guaranteed due to the 
condition Hi of definition [2J Let N (x) = p(x)E(x ) be a polynomial of degree less 
than k + w. 

Now consider the following system of equations 



(system 1 ) 


that has as unknowns the 2w + k coefficients of the polynomials E, N. Observe 
that the above system (with A as a parameter) is not homogeneous (due to the 
fact that E is monic). Recall that all steps up to this point follow exactly the 
Berlekamp- Welch algorithm (modulo the unknown A value). 

Now consider the slightly extended system below: 



(system 2 ) 


where E'(x) is a non-monic polynomial that has the same properties as E (i.e. 
E' and E have the same roots). It follows that system 2 defined above is homo- 
geneous with 2w + k + 1 unknowns. Let A 2 [A] be the n x (2w + k+ l)-matrix of 
system 2 . 

Due to condition i of definition [5] t he number of equations n satisfies 


n > 2w + k + 1 


and thus system 2 has at least as many equations as unknowns. 

Case 1 of the Attack. rank(A 2 [0]) = 2w + k + 1 (i.e., A 2 [0] is of full rank). It 
follows that there are 2 w + k + 1 linearly independent equations in system 2 
for A = 0 (and their locations can be recovered e.g. by Gaussian elimination). 
Without loss of generality let us assume that these are the equations on locations 
1, . . . , 2w + k + 1. We eliminate the remaining n — (2 w + k + 1) equations from 
system 2, to make it a square homogeneous system, and we call the remaining 
equations system 3. 

It follows that if we substitute the value a for A in the matrix of the system 
3, the matrix is singular since it accepts a solution (the polynomials E', N ) that 
is non-trivial. As a result the matrix of system 3, denoted by A 3 [A], has the 
following property: 


3a € IF : det(A 3 [a]) = 0 


Now observe that the determinant of system 3 is a polynomial /(A) := 
det(A 3 [A]) that is of degree at most w + 1 (because A is only involved in the 
part of the matrix of system 3 that corresponds to the polynomial E'). 

Further observe that /( 0) = det(A 3 [0]) /= 0 because of our selection ofA 3 [A] 
to have the property that A 3 [0] is the full rank minor of the matrix A 2 [0]. Thus, 
the value a is among the w + 1 roots of / and the output will be the list of roots 
of /. It follows that the above algorithm gives an efficient solution for the CAP 
problem. 
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Case 2 of the Attack. rank(A2[0]) < 2w + k + 1. In this case one can find a 
non- trivial solution of the system [0] which defines two non-zero polynomials 
E ' , N such that 

[E'iziH = N{ Zi j)U 

Since y \ = a(p(zi) + s$ + Ef) + p mS g(Zi ) + e* it follows that 

[E' (zi)(a(p(zi) + z k + Et) +p msg {zi) + ef) = N{ Zi )}U 

Let I be the subset of {1, . . . ,n} for which it holds that i £ I <£=>• (ej = 
0) A (Ei = 0). It follows that 

[E'izjp'izi) = N(zi)] ie x 

where p*(x) = a(p(x) + x k ) +p mS g(x). Recall that the degree of the polynomial 
N is less than k+w and E' is a polynomial of degree w. it follows that E'(x)p*(x) 
is a polynomial of degree w + k. 

Observe that |/| is a random variable (denoted by rj) ranging from n — w — W 
to n — maxjro, W}. Next consider this relation: 

rj > w + k (Sufficient Condition for Case 2) 

Under the above relation, it follows that |I| > w + k + 1 and as a result 
the polynomials E'(x)p*(x) and N(x) are equal. It follows immediately that 
p* = ^ ; naturally given p* we recover a immediately and non- ambiguously (in 
fact, in this case we will even be able to recover the value of the secret-key). 

Performing a worst-case analysis of the above, we know that rj > n — w — W 
and as a result the attack would go through as long as n—w—W > w+k <*=*> n > 
2w+W+k something that matches condition #1 of the | AF03 j -cryptosystem (cf. 
section UTll and thus the case 2 of the attack can be carried for the parameters of 
the cryptosystem (without even taking into account that rj would be somewhat 
larger than its lower bound n — w — W). 

On the other hand, it would be of interest to us to find a necessary condition 
for case 2 of the attack (the reason for this will become clear in section |3j) . This 
can be found by setting p to its highest possible value and requiring this to be 
greater than w + k: r] := n — rriax{/«;, W} > w + k: this is equivalent to: 

n > w + m ax {w, W} + k (Necessary condition for Case 2) 


3 The Increased Error Case 

The cryptosystem of |AF03| mandates that the number of errors introduced 
by the sender in the formation of the ciphertext is less or equal to n ~ w ~ k - 1 
(condition #1 of section 12.11) . to ensure unique decoding in the reduced PR- 
instance that is obtained after removing the W locations that contain the errors 
of the Public-Key. 
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We observe that the bound on w is unreasonably low, for the following rea- 
son: many of the errors introduced by the sender will fall into the error-area of 
the public-key, and thus they will not affect the decryption operation (i.e., intro- 
ducing a new error in an already erroneous location is a case where 1 + 1 = 1). 

To see this better, we can think of the sender in the cryptosystem to be 
playing the following game: he selects w points out of n and randomizes them. 
Since W of these points will be discarded by the receiver it follows that the 
number of the good points (out of the total n — W of good points) that will 
be randomized by the sender follow a hypergeometric distribution with mean 
value "~ w . It follows that the expected number of good points that will be 
randomized by the sender are w n ~~ . 

In order to ensure decoding for the decryption operation it suffices to force 
e < n ~ w ~ k - 1 where e is a random variable that follows the hypergeometric 
distribution with mean ra ~ w ' . Let w = n -w + n ~ w ~ k ~ 1 , for some e > 0. Using 
the Chvatal bound for the hypergeometric distribution, [Chv79] . we have that 

_ , r _ ,n — W . . _ , . n — W — k — 1. 

Prob[e > ( 1- e)tu] < e 2 => Prob[e > ] < e 2 

From the above, as long as e < W/n , if we set w = n _w "~ w 2 ~ fc ~ 1 it follows 

that the probability Prob[e > ”~ ty 2 ~ fc ~ 1 ] < e~ 2e w , and thus condition # 1 of 
section l2Tl will be satisfied in the probabilistic sense and decryption will succeed 
with probability 1 — e _2e w . 

We will concentrate on parameters s.t. W > w and w is selected as above. 
Consider for example the assignment n = 2000, k = 100, W > 1556 (to avoid 
an attack with |GS98] on the public-key), e.g. we set W = 1600, and e = 1/6; 
now observe that W/n = 0.8 > 1/6. The equation for w mentioned above yields 
w = 407. It follows that the probability of correct decryption is 1 — e~ 2 ~ae = 
1 — e -22 fa 1 — 2 -31 . Observe now that case 2 of Coron’s attack would be foiled 
since the necessary condition fails: 

n> w + max{w, W} + k <+=> 2000 > 1600 + 407 + 100 4=> false 

Thus, by merely increasing the number of errors that the sender of the cryp- 
tosystem introduces during encryption (relying on randomization to allow de- 
cryption with very high probability), we are capable of thwarting the analysis of 
Coron’s attack (in particular the analysis of case 2 of the attack). Observe that 
this is possible without any other modification of the cryptosystem whatsoever. 

Nevertheless, this is only a temporary comfort as we will prove in the next 
section. 

4 With High Probability Modified Coron’s Attack 
Succeeds Against Increased Errors 

Next, we use another probabilistic analytical tool to show that, in fact, in spite 
of the increased errors, the attack actually works with high probability. 
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First, observe the error-increase we introduced in section [3] does not apply to 
case 1 of Coron’s attack. Indeed, one can show for any e > 0 that 

1 n — W — k — 1 ^ n — k — 1 
W 2 - 2 

and the condition w < (n — k — l)/2 is sufficient for case 1 to go through (that 
is, if we can apply it) . Recall that case 1 of the attack only applies to the case 
det(A 3 [0]) f=0. 

We will show that this in fact happens most of the times (a fact observed in 
practice in |Cor03c] but not proved). This means that the attack works even in 
the increased error setting of the previous section. Let us recall the matrix of 
system 2, as defined in section 12.31 

A 2 [A] = (b 2 C 2 [A]) = 


(1 Zi ■ ■ ■ z^ +k 1 y[ - Ayr ( y[ - Xy^Z! . . . (y[ - Xyi)zf \ 

1 z 2 ... 2 ™ +fc_1 2/2 - A 2 / 2 ( 2/2 - Xy 2 )z 2 ... (y 2 - Xy 2 )z % 

\ 1 y' n - \i In (y' n - Xy n )z n . . . {y' n - Xy n )z ™ t 

where B 2 is a Vandermonde matrix of dimension w + k over the elements 

Zi,. . . ,z n ; B ‘2 corresponds to the coefficients of N(x): C 2 [ A] is a Vandermonde 
matrix of dimension w + 1 over the elements Z\, ... . z n where its i-tli row is 
multiplied by y\ — Aj/,;, for % = 1 , . . . ,n; C 2 corresponds to the coefficients of 
E'(x). Recall that A 2 [A] is a n x (2 w + k + 1) matrix. We would like to prove 
that rank(A 2 [0]) = 2 w + k + 1 with overwhelming probability. 

If rank(A 2 [0j) < 2w + k + 1 then it follows that any (2w + k + l)-minor of 
A 2 [0] is singular. Below we show that this event can only happen with very small 
probability (assuming that the underlying finite field F is large — something 
that is assumed in |AF03] 'I thus we deduce that the first case of the attack would 
work almost always. 

Theorem 1. Let P = Prob[raiik(T 2 [0]) < 2w + k + 1] be the probability that 
the rank of A 2 [0] is less than 2w + k + 1 where the probability is taken over all 
possible choices for the given CAP instance out of which we construct A 2 [A]. 
It holds that P < 2u;/|F| and the proof works even if the first inequality of 
condition i of definition [H is relaxed to only w < (n — k — l)/2. 


5 The Most General AF System Avoids Coron’s Attack 

5.1 An “Optimal Variant” of the Cryptosystem 

In this section we show that the number of errors w introduced by the sender 
can, in fact, be increased further beyond the improved bound that we describe 
in section [3j by employing the proper decoding method for decryption (cf. figure 
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[]]). In particular, we make the following crucial observation: |AFfl3] requires 
that w is below the error-correction bound of Reed-Solomon Codes, so that the 
decryption (decoding) is unique. Nevertheless the introduction of random errors 
in a large enough finite field (such fields are utilized in |AF03| ) suggests that 
uniqueness of decoding can be ensured far beyond the error-correction bound. 

In the lemma below we show that randomly selected PR instances that can 
accept two different decodings are unlikely. This probabilistic analysis allow us 
to resort to modern list-decoding techniques in the sequel. 

Lemma 1. Let {(zj, y,;)}" =1 be a RS-Code codeword of a random message p 6 
F[a;] with degree(p) < k that has e errors uniformly random distributed overW, 
s.t. e < n — k. Then, the probability that it accepts another decoding p' £ F[a;] 
with p f=p' is at most (") /(|F| n_e_fc ) (the probability is taken over all possible 
messages and noise corruptions). 

Now observe that if the “message rate” is re := k/n and the “error-rate” is 
e := e/n, with re, e £ Q + then it follows that the probability in lemma[T]is less 
than „)„ • As a result, provided that F satisfies |F| 1-e-K > 4 it follows 

that the probability of proposition [T] is “negligible.” 

Optimal Parameter Setting and Modifications for the Cryptosystem 

of [AF03] . Taking advantage of the above Lemma in conjunction with the 
observation of section[3j we can increase the error-parameter w further. We refer 
to our choice as optimal with respect to figure [T] under the basic assumption 
that the list-decoding algorithm of |GS98| represents the state of the art in RS- 
decodability. 

Below we assume that the sender employs the algorithm of [GS98] for decryp- 
tion. For this algorithm to work it should hold that e < (n — W) — y/{n— W)k 
where e is the number of errors introduced in the area of good points of the 
public-key due to the encryption operation. As argued in section 0 e is a ran- 
dom variable following a hypergeometric distribution with mean w ■ In our 
analysis below we will simply substitute e for the expected number of errors. 
Note that this does not guarantee that the receiver will be capable of recovering 
the transmitted message “most of the times.” To guarantee this we would have 
to show that the probability Prob[e < (n — W) — y/(n — is overwhelming 
(as we did in section |3), something that can not simply be inferred from the fact 
that the mean of e is less than ( n — W) — y/(n — W)k: in order for the receiver 
to be able to decrypt most of the times we would in stead requi re that the mean 
of e is sufficiently lower than the bound (n — W ) — y {n — W)h and then employ 
the Chvatal bound on the tails of the hypergeometric distribution to bound the 
error probability by a negligible fraction, |Chv79j (as in section 13). 

Nevertheless, since we intend to cryptanalyze the resulting cryptosystem, we 
will opt for simply substituting e for its mean, as this would only make our 
attack stronger. On the other hand observe that a public-key cryptosystem that 
works, say, half the times is still quite useful. Thus, substituting e for w n f l w we 
obtain 
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< (n - W) - y/(n— W)k 



We conclude that the optimal selection would allow the parameter w to be 
selected as high as: 



The new bound above increases the number of errors that we can allow the 
sender to introduce, as long as W is selected appropriately: 

Proposition 2. There are choices for W such that W > n — y/n(k — 1) and 
n(l — \j n-w ) as l° n 9 as k>5 and k/n < 1/16. 

Now recall that the necessary condition for Coron’s attack (both cases) is 
w < n ~ 2 ~ 1 - It follows from the proposition above that our analysis puts the 
parameter w beyond the range of Coron’s attack, provided that W is properly 
selected. To illustrate this concretely, suppose that n = 2500 and k = 101. 
Then, W should be selected in the range [2000, . . . , 2126]; if we make the choice 
W = 2063 then we can set w to be as high as 1298, whereas Coron’s attack 
would correct any value of w only up to 1199. Note that the gap of 99 elements 
between the bound of Coron’s attack and the assignment w = 1298 ensures 
that the application of the attack by removing 99 points at random would only 
succeed with probability less than (0.52)" « 2 -96 (since the ratio of the sender- 
introduced error points is ftf 0.52). 

Corollary 1. Coron’s attack cannot be applied against the \AF03f -crvvtosvstem 
in the optimal parameter setting. 

To draw a parallel to our exposition in section 1^721 we introduce the problem 
CAP+ to stand for the ciphertext-only attack problem of the optimal variant of 
Augot and Finiasz Cryptosystem, (the only difference from CAP being in the 
choice of w): 

Definition 3 Ciphertext-Only Attack Problem in the Optimal 
Parameter Setting ( CAP+). Given two sequences of tuples X- t := {(^, ; , y i )}/ =1 
and X 2 := 1 and parameters k,w,W that satisfy the following condi- 

tions 

i. w< n( 1 - y/^), and W >n — y/n{k-l). 

ii. {(zj, yi — Zi)}2=i is a random PR-instance with parameters [n, k, W] . 

Hi. 3agF such that {(zj, ayi)}™ =1 is a random PR-instance with parameters 

[n,k,w\. 


Goal. Find a list of values of polynomial-length that contains the value a. 
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As before we show that any algorithm that solves CAP+ can be used to 
mount a ciphertext-only attack on the cryptosystem of |AF03] (but now in the 
optimal parameter setting): 

Proposition 3. Let A be an algorithm that solves CAP+ in polynomial-time. 
Then any message encrypted in the cryptosystem of \AF03f in the optimal param- 
eter setting can be decrypted without knowledge of the secret-key in polynomial- 
time in the security parameter. 

In the Lemma below we give an upper bound on the value of w (that is 
independent of W ). 

Lemma 2. For any CAP+ instance, it holds that n — w > y/n 3 (k — 1). 


6 The Attack Against the General System Employing 
List-Decoding 

The results we present in this section (essentially an algorithm for solving CAP+) 
is based on Sudan’s list-decoding algorithm, |Sud97| and Guruswami Sudan 
|OS98| algorithms (for both there are efficient polynomial-time algorithms, see 
|McE03j h 

6.1 The Attack 

Let n,k,w,W gZ and X% = {fyi, ?/,)}"=!, A 2 = {(zj,^)}^ x be an instance of 
CAP+. We denote y, := y\ — Xyi for i = 1 . ... ,n, where A is an unspecified 
parameter (free variable); to set the parameter A to a specific value a we will 
write yi[a]. 

According to the definition of a CAP+ instance we know that there exists 
a value a G F (the “encryption coefficient”) and a polynomial p G F[x] of 
degree less than k (the “message polynomial”) that agrees with n — w of the 
points (zi,yi[a\). Define l := n — w— 1. Next we consider the following system of 
equations on a set of unknowns {Qj 1 .j 2 }j 1 >o,j 2 >o,j 1 +(k-i)j 2 <i (called system 4): 

Vi G {1, . . . , n} qj, zf 1 yP = 0 (system 4) 

Observe that any solution to system 4 above defines a bivariate polynomial 
Q(x, y) that satisfies the property degree^.,. + (k — l)degreeg y < l. 

Lemma 3. The number of unknowns of system 4, is at least jjjrrrj- 

Recall that from proposition [2] we know that we only consider parameter 
choices that satisfy k/n < 1/16. For such range of parameters (and sufficiently 
large n) we, in fact, show: 

Lemma 4. System 4 is not overdefined provided that n > 19 and k/n < 1/9. 
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Subsequently we omit the appropriate number of unknowns from system 4, 
to equalize the number of unknowns and equations. This results in a square 
homogeneous system of n equations and unknowns that we call system 5. We 
denote the matrix of system 5 by A [A]. 

Theorem 2. Let a £ F be the “encryption coefficient” for a CAP+ instance 
as defined in item Hi of definition 0 The matrix A[a] as constructed above is 
singular. 

Since A\d\ is singular, it follows that if we define the polynomial /(A) := 
Det(A[A]), a will be among the solutions of /(A). Thus we can solve CAP+ by 
computing all the (polynomialy many, by degree constraint) roots of /(A). 

Theorem 3. The probability P that the polynomial /(A) = Det(A[A]) is the 
zero-polynomial satisfies P < 2 s(n — l)/|IF|, where s = LiEyJ (the maximum 
degree of the y-variable in any of the columns of A[A]j. 

7 Summary 

In this section, we summarize our cryptanalytic results. 


Given an instance of CAP+ {(2i,2/i)}” = l7 {(zi, j 4)}” =1 with parameters n,k,w,W. 

0. Set im n - w — 1. 

1. Select D C IN x IN so that D = n and for all (ji-.j?) £ D, ji + (k — l)j 2 < l 

2. Let D = £#i[l] jafl]),. . . , 0’i[ n ]i J 2 [n])^, a lexicographic ordering of D. 

3. Construct a (n x n)-matrix A so that its (i,i')-entry equals z — A? /») 32 ^^ 

4. Compute /(A) := det(A[A]) symbohcally to obtain the polynomial / on A. 

5. Output all roots of /. 


Fig. 2. The algorithm that solves CAP+ 


First in figure |2] we overview the CAP+ algorithm that was presented in 
the previous section. Using this, the general cryptosystem based on Augot and 
Finiasz |AF03] . even under the optimal choice of parameters is broken under 
ciphertext-only attacks. The breaking algorithm is summarized in figure [3 


Given the public-key and a ciphertext of the |AF03 |-crvptosvstem with parameters 
n,k,w,W. 

1. if w < n ~2 ~ 1 invoke case 1 of Coron’s attack. 

2. else invoke the CAP+ algorithm of figure 1, and recover the plaintext using 

Guruswami-Sudan algorithm ( as described in proposition EJ. | 


Fig. 3. The attack against the Generalized Version of | AF03| -CrvDtosvstem 
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Note that the attack outlined above is probabilistic and is guaranteed to work 
with very high probability as we have shown in theorem [T] (for case 1 of Coron’s 
attack), and theorem [3] (for CAP+ algorithm). 
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Abstract. An untraceable fair network payment protocol is proposed by 
Wang in Asiacrypt’03, which employs the existent techniques of the off- 
line untraceable cash and a new technique called restrictive confirmation 
signature scheme (RCSS). It is claimed that the fair payment protocol 
has both the fairness such that the buyer obtains the digital goods if and 
only if the merchant gains the digital cash and the untraceability and 
unlinkability such that no one can tell who is the original owner of the 
money. In this paper we show that the fairness is breached under a simple 
colluding attack, by which a dishonest merchant can obtain the digital 
money without the buyer obtaining the goods. We also apply the attack 
to some of the schemes of fair exchange of digital signatures proposed 
by Ateniese in ACM CCS’99. Our study shows that two of them are 
subjected to the attack. A countermeasure against the attack is proposed 
for the fair exchange of digital signatures. However, we are unable to fix 
the fair payment protocol if the untraceability and unlinkability are the 
required features. 


1 Introduction 

In Asiacrypt 2003, Wang proposed an untraceable fair network payment proto- 
col, which is claimed to have untraceability, unlinkability and fairness [25]. The 
protocol is for online purchasing of digital goods with digital money. A buyer 
withdraws untraceable and unlinkable digital cash from a bank and buys some 
digital goods from an online merchant with the digital cash. The fairness is a 
feature that prevents either the buyer or the merchant from taking the advan- 
tage of the other. It guarantees that the buyer can obtain the goods if and 
only if the merchant gains the money. The protocol combines the techniques 
of the untraceable offline e-coin ([8], [5]) and a new primitive called restrictive 
confirmation signature scheme (RCSS). By RCSS, a signature confirmed by a 
designated confirmer can only convince some specified verifiers. In this paper 
we present a colluding attack where a dishonest merchant can breach the fair- 
ness such that he can obtain the money without the buyer obtaining the goods. 
The problem with the protocol is that the money is the untraceable and unlink- 
able e-coin, which has no link with the buyer’s ID and hence can be separated 
from the RCSS-signed order agreement. That is the vulnerable point our attack 
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exploits. The attack does not work if the digital money is internally linked to 
the buyer’s ID. But the untraceability and unlinkability would be lost in that 
case. 

We can also apply a similar colluding attack to the schemes of fair exchange 
of digital signature proposed by Ateniese in [4]. There are six schemes in [4] 
for fair exchange of 1) RSA signatures; 2) Gennaro-Halevi-Rabin signatures; 
3) Cramer-Shoup signatures; 4) Guillou-Quisquater signatures; 5) Schnorr (or 
Poupard-Stern) signatures; and 6) ElGamal (or DSA) signatures, respectively. 
We show that 5) and 6) are subject to the attack, while 1), 2), 3) and 4) are 
not. The schemes 1), 2) and 3) have the same principle as Boyd-Foo scheme in 
[?], where TTP performs different converting functions for different users. The 
colluding attack does not apply to such schemes. The scheme 4) is an improved 
version of Bao-Deng-Mao scheme in [5]. A flaw of [5], which was first pointed 
out in [7], is removed in 4). The reason why 5) and 6) are subject to the at- 
tack is that Schnorr signatures and ElGamal signatures have a special feature, 
which Guillou-Quisquater signatures do not have. The feature does not affect 
the security requirements of digital signature. However, it is the key point in 
determining whether the attack works. The feature will be discussed later in 
this paper. The attack works only if the system allows new users to register at 
any time. 

The rest of the paper is organized as follows. In Section [2], we describe the 
untraceable fair payment protocol proposed in Asiacrypt’03. In Section [3] we 
present a colluding attack breaching the fairness of the protocol and explain why 
the attack works. In Section 0, we describe the two schemes of fair exchange of 
digital signatures proposed in ACM CCS’99. In Section^ we discuss the special 
feature of digital signatures that we exploit and present the colluding attack to 
the two schemes. We also give the countermeasure against the attack. Section HI 
concludes the paper. 

2 Untraceable Fair Network Payment Protocol 

In this section we describe the untraceable fair network payment protocol pro- 
posed in (25). For simplicity, we skip the details of the building-block RCSS 
(restrictive confirmation signature scheme) and put it in the Appendix A for 
interested readers. We also simplify the description of the protocol by assuming 
that the payment is in one e-coin instead of n e-coins as in 1111- 
Entities 

U — the buyer, who buys soft goods from the merchant. 

M. — the merchant, who sells the soft goods to the buyer. 

B — the bank, who issues e-coins to the buyers. 

TTP — the trusted third party, who resolves dispute in payment protocol. 

System Parameters and Cryptographic Keys 

p, q, g — p. q large primes, q\p — 1, g a generator of the subgroup G q of order q 
ofz;. 
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Ub,xb — B’s public and private keys, yg = g XB mod p. 

Http, xttp — TTP’s public and private keys, Uttp = g XTTP mod p. 
gi,g -2 — two elements of G q published by B, for e-coin scheme. 

Two Building-Block Techniques 

RCSS — restrictive confirmation signature scheme. In RCSS, a signature signed 
by a signer S can be confirmed by a confirmer C, and C can convince only some 
specified verifiers Q that the signature is vahd and truly signed by S. RCSS is 
the main technique designed for the fair payment protocol in [25]. It is denoted 
by Sign RC ss(S , C,Q,m). 

BP — interactive bi-proof of equality. In BP either log a Y = log ;3 Z or 
log a Y ^ log /3 Z is proved. The proof system is denoted by BP(a, Y, (3, Z) in 
|25l , where no detailed description of BP is presented but the reader is referred 
to |^6] and |l9| . 

The untraceable fair network payment protocol consists of five processes, 
namely account opening, withdrawal, payment, dispute and deposit. The details 
are as fohows. 

Account Opening 

The buyer U randomly selects u\ G Z g and transmits I = <j\ Ul mod p to B if 
Ig 2 ^ 1. The identifier I used to uniquely identify U can be regarded as the 
account number of U. Then B publishes g\ XB (we omit mod p here) and g 2 XB 
so that U can compute z = (Ig-i) XB = {gi XB ) Ul g2 XB for himself. 

Withdrawal 

The buyer U performs the following protocol to withdraw an e-coin from the 
bank: 

1. B randomly selects w eZ* and sends e\ = g w and e 2 = {I g r i) w to U. 

2. U randomly selects s,x\,x 2 € Z* and computes A = ( Ig 2 ) s , B = gi Xl g 2 X2 
and z' = z s . U also randomly selects u,v,t c £ Z* and computes e[ = 
Bi w g v ,e' 2 = e 2 su A v and ( a c ,b c ) = ( g tc ,VTTP tc )• Then U sends c = d /u 
mod q to B, where d = H(A, B, z\ d x , d 2 , b c ) + a c mod q, where H is a 
collision-free hash function to Z*. Note that (a c , b c ) is a pair of confirmation 
parameters. 

3. B sends r = cx R + w mod q to U. 

4. U verifies whether g r = y TTP c e-i and ( Ig 2 ) r = z c e 2 . If the verihcation holds, 
U accepts and computes r' = ru+v mod q. Note that < A, B, (z', d x , d 2 ,d, 
a c , b c ) > represents a pseudo e-coin. 


Payment 

The Buyer U and the merchant M. exchange the e-coin and the soft goods in 
this protocol. In the original protocol multiple e-coins are traded for the soft 
goods. We present a simplified version of one e-coin without loss of generality. 

1. U selects goods and signs an order agreement 9 = Sign rc s s{B -M , TTP. OA), 
where OA = { I Du, I Dm , purchase data/information, goods description, 
(■ A,B )}. 
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2. U sends the pseudo e-coin < A, B, (z 1 . e \ , e' 2 , r', a c , b c ) > and 9 to M. 

3. A4 verifies the pseudo e-coin and 9. If all of them are valid and A ^ 1, then 
he sends d = H(A, B, I Dm, date/time) to U. 

4. U sends fci = du\s + x\ mod q and k 2 = ds + x 2 mod q to U. In addition, 
U must run the interactive protocol of bi-proof BP(g. a c . uttp, b c ) with A4 
to show log s a c = log yTTp b c . 

5. M accepts the pseudo e-coin and the payment transcripts < A , B, (/, e\ , e' 2 , 
r', a c , b c ), (d, k x , k 2 ) > if the following verifications hold: 



A r’ _ z rH(A,B,z \ 

gi kl g2 k2 = A d B 


If the above verifications pass, M sends the soft goods to the buyer U. 

6. U checks the soft goods delivered by M. If it matches the description in OA, 
U releases t c to M. Since each one can check a c = g tc and b c = Vttp tc by 
himself, the coin < A, B , (V, e^, e' 2 , r' , a c , b c , t c ), (d. k\ , k 2 ) > (i.e., the pseudo 
e-coin plus t c ) denotes a true e-coin that can be directly cashed from the bank. 


Disputes 


If U refuses to send t c to the merchant M., M. begins the dispute process in 
which TTP can convert the pseudo e-coin into the true e-coin. 

1. M. sends the order agreement OA, the RCSS signature 9, the soft goods and 
the pseudo e-coin < A, B, ( z' , e\, e' 2 , r' , a c , b c ). (d, k\,k 2 ) > to TTP. 

2. The TTP checks the validity of the soft goods, pseudo e-coin and signa- 

ture 9. If the pseudo e-coin is constructed properly, the soft goods from M. 
is consistent with the description in OA, and 9 is valid, TTP sends M. a 
transformation certificate TCer = ( E C ,T C ), where E c = a,. 17 (a is a random 
number selected by TTP) and T c = a +xttpF(cl c , E c ) mod q (F is a public 
collision- free hash function). The transformation certificate can be used to 
verify the relation of a c and ' ‘ 1 '' ' equation: 



3. TTP sends the soft goods to the buyer U. 

Deposit 

In a normal case, M. forwards the payment transcript and the true e-coin 

< A, B, (z' , e), efy r' , a c , b c , t c ), (d. k\ . k 2 ) > to the bank for deposit. Neverthe- 
less, if U maliciously aborts the payment process, M can start the dispute 
process to acquire the TCer from TTP. In this situation, the pseudo e-coin 

< A, B, (z 1 , e'j, e' 2 , r' , a c , b c ), (d, fci, fe) > plus TCer = (E c , T c ) can be the valid 
token for deposit. We can also regard < A, B, (V, e' x , e' 2 , r' , a c , b c ), (d, ki,k 2 ), (E c , 
T c ) > as a true e-coin with different form. 

3 Analysis of the Fair Payment Protocol 

Before presenting our analysis, we copy the claimed security features of the fair 
payment protocol, which are expressed in the form of propositions and lemmas 
in [25] . 
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Unforgeability. No one except U can create his own pseudo e-coin < A, B, [zJ , 
e' x ,e' 2 y, a c ,b c ),(d,k 1 ,k 2 ) >. 

Indistinguishability. No one can distinguish between a valid pseudo e-coin and 
a simulated one without the help of the buyer or TTP. 

Convertibility. If M. accepts the pseudo e-coin, it is guaranteed that TTP can 
later convert the pseudo e- coins into the true e-coins which can be directly de- 
posited in the bank. 

Fairness. If the above unforgeability, indistinguishability and convertibility hold 
for the proposed payment protocol, it can be guaranteed that at the end of the 
transaction, the buyer U can obtain the soft goods if and only if the merchant 
M. can gain the equivalent true e-coin. 

Untraceability. No one except M. and TTP can confirm the signature 9. That 
means only M. and TTP can be convinced that the order agreement OA is valid. 

Unlinkability. The bank or other parties cannot link a coin < A, B, (z! , e\ . e' 2 ,r' , 
a c , b c ) > to the original owner. 

Idea of the Colluding Attack 

In the fair payment protocol, the merchant Ai colludes with his conspirator C. 
After M receives the pseudo e-coin from the buyer U , M brings the pseudo e- 
coin to TTP but claims that the trade is between C and M.. Then the TTP will 
convert the e-coin to an equivalent true e-coin for M and send the soft goods to 
C, while U will gain nothing. Next we present the attack in details and explain 
why there is no solution against the attack. 

Attack Details and Explanation 

1. The malicious merchant M. honestly implements the Payment protocol till 
step 5. After the verifications pass, he halts the protocol. That is, he obtains 
the valid pseudo e-coin without giving the soft goods. 

2. Then M. asks his conspirator C to sign a forged order agreement between M. 
and C, 9' = SignRcss(C , M,TTP, OA') where OA' = {IDc, ID M , purchase 
data/information, goods description, ( A,B )}. 

3. M. starts the Dispute process by sending the order agreement OA 1 , the RCSS 
signature 9 1 on OA', the soft goods and the pseudo e-coin < A, B, (z' , e\ , e ' 2 , 
r',a c ,b c ), (d,ki,k 2 ) > to TTP. Note that TTP has no way to tell whether 
OA’ and 6' are consistent with the pseudo e-coin or not because of the 
unlinkability and untraceability. Note that the d in the pseudo e-coin is d = 
H(A,B,IDm, date/time) instead of d = H(A,B, ID M JD U , date/time). If 
d is replaced with d = H(A,B,IDm,ID u , date/time), the attack does not 
work anymore but the unlinkability and untraceability would disappear. 

4. TTP converts the pseudo e-coin into a true e-coin for M. and forwards the 
soft goods to C. The buyer U is left without obtaining anything. 

5. The problem of the fair payment protocol is that the e-money is in the form 
of digital cash, which is generated with the bank’s private key and has no 
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link with the buyer U. If the e-money is in the digital cheque form that is 
generated with U's private key, the attack would not work. 

6. The protocol cannot be fixed by asking U to sign a pre-contract to indicate 
that the trade is between U and M. or by any other means. The conspirator 
C can just simulate U by doing everything U does. No one can distinguish C 
from U since the money is unlinkable and untraceable. 


4 Fair Exchange of Digital Signatures 

Fair exchange protocols have been studied by many researchers in recent years 
in (TJ, j2|, [3], [4], [Q, [6], [7], Q flT2|, [15], [20], [26] and many other papers. 
Among them, [2], [4] and |5] have the same principle in employing verifiable 
encryption schemes (VES) of digital signatures. In g], six schemes are proposed 
in its sections Ej], |4.2| . 4.3, 4.4, 4.6 and 4.7, respectively. The first three schemes 
are actually not by VES but by the same method of [7]. The latter three schemes 
exploit the VES of Guillou-Quisquater signatures, VES of Schnorr signatures and 
VES of ElGamal signatures, respectively. We describe the latter two here in the 
same denotations as in [4]. Before our description, we introduce a technique that 
is the main building-block for the schemes. 

Building-Block EQJDLOG{m\ gi x ,g 2 x ", gi, gi) 

EQ_DLOG(rrv,yi,y 2 -,gi,g 2 ) is a non-interactive proof system for proving 
Dlog gi yi = Dlog 92 y 2 without disclosing the value x = Dlog gi y\ = Dlog 92 y 2 - 
The proof is associated with a message m. Here g\,y\ G group Gi, g-i , y-i G 
group G 2 , and at least one of G\ and G 2 has an unknown order with bit-length 
l. Let H be a hash function {0, 1}* —* {0, l} k and e > 1 be a security parameter. 
The proof EQJDLOG(m, yi, y^\ < 71 , 52 ) is implemented as follows. 

Prover: randomly choose t G [— 2<V+ fc ), 2 e d+ fc )] ) compute c = W(m||r/i||t/ 2 |]<?i||<? 2 || 
and .s = t — cx (in integer Z). (s, c) is the proof/signature of EQ DLOG 
(m; 3/i, 2 / 2 ; 51 , 52 ) • 

Verifier: given (s, c) and (m, y u y 2 , gi, g 2 ), check if c = H{m\ |r/i| Mlfllllftil \giVi c \ \ 
g 2 s y 2 c ) and s G [— 2 e G+ fe ) , 2 e G+fc)]. if both hold, the verification is passed. 


4.1 Fair Exchange of Schnorr Signatures 
Settings 

• System parameters: The system parameters are p, q and a, where p, q are 
primes and q\p — 1, a is an element of order q of Z*. 

• TTP: TTP has a pair of public/private keys (n, g ) /(factors of n) for ei- 
ther Naccache-Stern encryption scheme m (or Okamoto-Uchiyama encryption 
scheme [2l|j ). The encryption of M under the public key (n, g) is g M mod n (or 
h r g M mod n). M can be computed if the factors of n are known. It is claimed 
in [T] that both schemes can be adopted but for the sake of simplicity Naccache- 
Stern encryption scheme is employed. 
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• Alice: Alice has a pair of public/private keys y/a for Schnorr signature 
scheme where y = a a mod p. 

• Bob: Bob also has a pair of public/private keys for signature. Bob’s signa- 
ture on message M is denoted by Ssob(M). 

• Message: m is a message, on which Alice and Bob are exchanging their 
signatures. 

Fair Exchange by Verifiable Encryption 

1. Alice generates her signature S AUceijn) = (s, e), where r = a k mod p, e = 
H(m\\r) and s = k + ea mod q, for a randomly chosen k from Z q . The 
verification of SAUceijn) is to check if e = 'H(rri\\a s y^ e ). Alice encrypts s 
with TTP’s public key (n, g) by setting the ciphertext to be C = g s mod n. 
The e is left in plaintext, from which no one else can compute s. Since Alice 
knows s, she can implement EQ_DLOG{m\V,C\a,g) for V = a s mod p. 
Then Alice sends the verifiable encryption of S AUce{m) to Bob. That is 
(C, e, V) plus the proof of EQJ)LOG(m ; V, C ; a, g). 

2. Bob checks the proof of EQ_DLOG(m-,V,C;a, g) and e = H(m\\Vy~ e ), if 
valid, sends S Bob(jn) to Alice, otherwise does nothing. 

3. Alice verifies Bob’s signature and, if valid, sends S AUce{ m ) to Bob. 

4. If Bob does not receive anything or if Alice’s signature is invalid, then he 
sends the verifiable encryption of S AUce(m) and S Bob (nr) to TTP. This pro- 
vides a vehicle for TTP to understand whether the protocol was correctly 
carried out. If this is the case, TTP sends S AUce( m ) to Bob and S Bob(m) to 
Alice. 


4.2 Fair Exchange of ElGamal Signatures 

The settings are exactly the same as in the fair exchange of Schnorr signatures 
in Section IPl The scheme of fair exchange of ElGamal signatures is as follows. 

1. Alice generates her signature S AUce(m) = (s. r), where r = a k mod p and 
s = k'H{ni)+ar mod q, for a randomly chosen k from 7L q . The verification of 
S Alice (m) is to check if a s = r' H(jn h/ r mod p. Alice encrypts s with TTP’s 
public key (n, g) by setting the ciphertext to be G = g s mod n. The r is 
left in plaintext, from which no one else can compute s. Since Alice knows 
s, she can implement EQ_DLOG(m;V,C-,a,g) for V = a s mod p. Then 
Alice sends the verifiable encryption of S AUce{m) to Bob. That is (C, r, V) 
plus the proof of EQ_DLOG(m; V , C; a, g). 

2. Bob checks the proof of EQ DLOG(m-, V, (7; a, g) and V = r H ^ rn ' , y r mod p, 
if valid, sends S n<>h(jn) to Alice, otherwise does nothing. 

3. Alice verifies Bob’s signature and, if valid, sends S AUce{tri) to Bob. 

4. If Bob does not receive anything or if Alice’s signature is invalid, then he 
sends the verifiable encryption of S AUce(m) and S/ 3 0 j,(m) to TTP. This pro- 
vides a vehicle for TTP to understand whether the protocol was correctly 
carried out. If this is the case, TTP sends S AUceijn) to Bob and S Bob{fn) to 
Alice. 
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5 Colluding Attacks and Countermeasures 

5.1 A Feature of Digital Signatures 

The digital signatures we consider here are those that consist of two parts, such 
as the (s, e) of Schnorr scheme, the ( s , r) of ElGamal scheme, the (d. D) of 
Guillou-Quisquater scheme and similar signatures of many other schemes. Let 
us denote a signature on message m with public/private keys PK/SK by (X, Y), 
and the verification formula of the signature by 

Vef(m,X,Y,PK) = 1 (1) 

The security requirement of digital signature demands that, for given PK, 
it is infeasible to compute to and ( X , Y) such that (1) holds without knowing 
SK. (That is the unforgeability in passive attack model. In active attack model, 
the security requirment is that it is infeasible to forge a valid signature without 
knowing SK even given a signing oracle.) However, the following feature is not 
prohibited for the security of signatures, while it plays an important role in our 
colluding attack. 

Feature. Given m, (X, Y),PK that satisfy (1), it is easy to find Y' ^ Y 
and PK' ± PK such that Vef (m,X,Y',PK') = 1 without knowing 
SK. 

Schnorr Signature. Given a signature (s, e) on message to such that e = 
H(m\ \a s y~ e ), we can always find e! ^ e and y' ^ y such that e' = Ti(m\ \a s y'~ e ). 
We just take e 1 = 'H(rn\ \a s o') for a randomly chosen t £ Z q , and then set 
x' = —tie 1 mod q and y' = a x mod p. Hence Schnorr signatures have the 
feature. 

ElGamal Signature. Given a signature ( s,r ) on message to such that a s = 

f'HMyr moc j p, we can g nc j r ' ^ r anc i y’ ^ y gnch that a s = r ,n ^y’ r 

mod p. We take r' = {a s mod q for a randomly chosen t £ Z g , and 
then set x ’ =t/r ’ mod q and y’ = a x mod p. Hence ElGamal signatures have 
the feature. 

Guillou-Quisquater Signature. In Guillou-Quisquater scheme, n = pq is gen- 
erated by a trusted center, where p and q are safe primes. A large prime v is 
selected, and n and v are published as system parameters. The p, q are recom- 
mended to be destroyed after that. (It is also allowed that n is generated by 
each signer. In that case different signer has different n,v.) The public/private 
keys J/B have relation B V J = 1 mod n. A signature (d, D) can be generated 
with the private key B by setting T = r v , d = H(m\\T) and D = rB d , where 
r is randomly chosen from Z„. The verification of ( d,D ) is d = 'H{rn\\D v J d ). 
To generate d' ^ d, J' ^ J such that d' = Ti(m\\D v J' d ) is not as simple as the 
problems for Schnorr and ElGamal signatures. We cannot solve the problem of 
computing the d'th-root mod n since the factorization of n is not known. 
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5.2 Attack to Fair Exchange of Schnorr and ElGamal Signatures 
Attack to Fair Exchange of Schnorr Signature by Dishonest Bob 

1. Alice generates her signature S AUceim) = ( s,e ), where e = H{m\\r) and 
s = k + ea mod q for randomly chosen fceZ, and r = a k mod p. The 
verification formula of S AUce(m) is e = H(m\\a s y~ e ). Alice encrypts s with 
TTP’s public key (n, g) by setting the ciphertext to be C = g s mod n. Then 
she implements EQ DLOG(m\ V, C: a, g) for V = a s mod p and C = g s 
mod n. After that Alice sends the verifiable encryption of S AUceim) to Bob, 

i.e., (C, e, V) plus the proof of EQ_DLOG(m ; V, C\ a, g). 

2. Bob checks the proof of EQ.DLOG{m\V,C\a,g) and e = H(m\\Vy~ e ), if 

valid, halts the protocol. Then he computes e', y' such that e' = H(m\\Vy'~ e ), 
i.e., d = H(m\\ Va f ) for t Gr and y' = mod ^ mod p, and asks 

his conspirator Cathy to register y' as her public key. Bob can ask Cathy to 
sign (C, e',V) and any other things that could be signed by Alice for any 
possible authentication. 

3. Bob sends (C, e' , V ), the proof of EQ_DLOG(m; V, G\ a, g) and S Bo f,(rn) to 
TTP and claims that the exchange is between Cathy and Bob. 

4. TTP first verifies the proof of EQ_DLOG{m\ V, C; a, g), then decrypts s and 
verifies whether (s, e') is a valid signature of Cathy and whether S nobim) is a 
valid signature of Bob. If all the verifications pass, TTP sends Scathy{m) = 

(. s,e ') to Bob and S Bob(m) to Cathy. Hence Bob obtains Alice’s signature 
(s, e) without Alice obtaining anything. 

Attack to Fair Exchange of ElGamal Signature by Dishonest Bob 

1. Alice generates her signature S AUce(m) = (s. r), where r = a k mod p and 

s = + ar mod q for a randomly chosen k from Z, r The verifica- 

tion formula of S AUce{m) is a s = r H(n Gy r mod p. Alice encrypts s with 
TTP’s public key (n, g) by setting the ciphertext to be C = g s mod n. 
Then she implements EQ DLOG{m-, V. G\ a, g) for V = a s mod p. Finally 
Alice sends the verifiable encryption of S AUce(m) to Bob, which is (C, r, V ) 
plus the proof of EQ_DLOG{m ; V, C: a, g). 

2. Bob checks the proof of EQ.DLOG{m\ V, C; a, g) and a s = r H ^y r mod p, 

if valid, halts the protocol. Then he computes r', y' such that a s = r ,W(m) y ,r 
mod p, i.e., r' = (V / mod 9) f or t g R z q and y' = mod «) 

mod p, and asks his conspirator Cathy to register y' as her public key. Bob 
can ask Cathy to sign (C,r',V) and any other things that could be signed 
by Alice for authentication. 

3. Bob sends (C,r',V), the proof of EQ.DLOG(m-, V, (7; a, g) and S Bob{m) to 
TTP and claims that the exchange is between Cathy and Bob. 

4. TTP first verifies the proof of EQ_DLOG(m-,V,C-,a,g), then decrypts s 
and verifies if (s,r') is a valid signature of Cathy and if S Bob(m) is a valid 
signature of Bob. If the verifications all pass, TTP sends Scathyim ) = (s, r') 
to Bob and S nobim) to Cathy. Hence Bob obtains Alice’s signature (s, r) 
without Alice obtaining anything. 
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For some applications it is possible that message m implies the two parties 
to be Alice and Bob instead of Cathy and Bob. However TTP is not supposed 
to semantically understand the content of m. TTP only confirms that the m in 
the EQJDLOG proof is identical to the m in the signatures. 

5.3 Countermeasures 

Before presenting our countermeasure, we show an interesting fact that the at- 
tack does not apply to DSA signatures. In DSA scheme, a signature (s, r) under 
public key y satisfies r s = a H( - m ^y r mod p. Although it is also simple to com- 
pute r',y' such that r ,s = a H( ' rn '>y' r mod p, the attack does not work anymore 
because the commitment V is different from that of ElGamal signatures. In El- 
Gamal scheme V = a s while in DSA V = r s . Therefore, in DSA the proof 
is EQ_DLOG{m\ V,C;r,g). Recall that the proof of EQ_DLOG{m-,V,C-,r,g ) 
is (c,<t) satisfying c = W(m||F||C||r|fy||r CT y c ||<?°'C' c ). That is, r is included in 
the verification of ( c,a ). An r' ^ r would make (c, a) fail to pass the verifica- 
tion. Forging a new proof of EQ DLOG(m\ V, C: r',g) is impossible since it is 
equivalent to knowing s. 

Now it is easy to see that the countermeasure is quite simple: Alice includes 
her ID (or her public key) into the proof, i.e., EQ_DLOG(m\ \ IDju ice \ V , C\ a, g). 
Even better, she includes more detailed information 1 about the exchange in the 
proof, i.e., EQ_DLOG(m\ | X; V. C\ a, g). In such case, T is like a label that cannot 
be removed and replaced. While attaching S AUce^) is like a label stick from 
outside and can be replaced, and therefore is useless. The ASW fair exchange 
scheme in [2] is not subject to the attack since a similar label is adopted. 

Such label technique would destroy the untraceability and unlinkability, there- 
fore cannot be adopted to fix the fair payment protocol. 

6 Conclusions 

In this paper we present a colluding attack to breach the fairness of an untrace- 
able fair payment protocol and two schemes of fair exchange of digital signatures. 
Their fairness actually has no problem in the situation where only the entities 
described in the protocols exist. The cryptographic techniques employed are also 
secure and efficient. However, the security flaws appear if we consider the real 
situation where more entities exist. 

As many security experts have pointed out, security does not equal to cryp- 
tography and good cryptographic algorithms do not automatically guarantee the 
security of application systems. Every component is secure does not necessarily 
mean that the whole system is secure. For complex systems, security should be 
studied under various attacks from various angles very carefully. It takes long 
time and big effort before being able to make an assertion. 

Another viewpoint reflected from the result of this paper is that the concrete 
implementation is very critical to security. We show that a tiny difference, such 
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as whether to include r in EQ_DLOG(rrr, V, C; r, g), could make a big difference 

in security. Hence engineers who implement the security schemes should be very 

carefully in following every step of the schemes. 
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A Restrictive Confirmation Signature Scheme 

In [25], RCSS is designed as follows. 

- System Setup. The parameters p, q and g, where p. q are primes such that 
q\p—l and g is an element of Z* of order q. F x , F- 2 are two collision resistant 
functions. The private/public key pairs of the signer S, the confirmer C, 
the recipient R and the verifier V are (xs, y% s mod p), (xc-, Vcf mod p ) , 
(xrjUr 1 mod p) and (xy, yf v mod p), respectively. 

- Signing Protocol. Assume the signer has signed an undeniable signature 
( a,b,S ) on message to related to the confirmer’s public key, i.e., a = g f 
mod p,b= yc l mod p and 6 = (F\ (m \a)+b) xs mod p, where t is randomly 
chosen by S. For delegating C the ability of confirming this signature, the 
signer randomly selects k,u,v i,u 2 and constructs a proof of 

(w,z,u,v i,v 2 ) = Proof DVLogE Q{c,g,ys,Fi(m\\a) +b,S,y v ), 

where c = (ci||c 2 ), c\ = g u yv Vl mod p, c 2 = g u yc V2 mod p, w = F 2 (c||fl||ys|| 
Fi(m||a) + &||£||g fc ||(.Fi(mj|a) + b) k ) and z = k - x s (w + u) mod q. Thus, 
the RCSS on to denotes SigriRcss{S, C, V, to) = (a, b , u, vi,V 2 ,w, z, 6). 
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Proof by the Signer. The confirmer C also plays the role of the recipient 
R. That means C will be convinced that he is able to prove the validity 
of the signature to V in this procedure. C checks the proof by computing 
c = (( g u yv Vl m od p) 1 1 (g u yc V2 mod p)) and verifying if 

w = F 2 {c\\9\\ys\\F x {m\\a) + »W (w+ ^iM|a) + 

To prove the relation of a and b, the signer needs to run the interactive 
protocol of bi-proof BP(g, a, yc, b) to show log ff a = log 9c , b. 

Confirmation Protocol. The confirmer C can prove the validity of the 
signature to V by running the interactive protocol bi-proof BP(g,yc,a,b) 
with V to show log s yc = log a b. The verifier V needs to check whether the 
signature (a, b, u, vi,V 2 , w, z, S) is created properly, and he can be convinced 
that the signature is valid if he accepts the proof of BP(g , yc, a, b). 
Conversion Protocol. The confirmer can convert the designated confirmer 
signature to a general non-interactive undeniable signature. Since the signer 
has constructed the designated verifier proof in a non-interactive way, V can 
check the validity of the signature by himself. The verifier V no longer needs 
to ask C to help him verify the signautre. Here, C randomly selects a GZ* 
and computes E = a a mod p and T = a + xcF(a, E) mod q, where F is 
also a hash function. The confirmer sends (E, T) to the verifier V, thus, V 
can verify if a T = Eb F{a ' E ) [10]. 
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Korea now has world-class IT infrastructure such as broadband Internet and 
mobile communications, and produces high-quality products based on broad- 
band networks and IT technologies including semiconductors, mobile handsets, 
digital TV, etc. The achievement was made possible thanks to new services that 
create demand, establishment of infrastructure that enables the provision of new 
services, and enhanced manufacturing capability. To formulate a new virtuous 
cycle, the Ministry of Information and Communication (MIC) developed the 
IT839 Strategy. 

The IT839 strategy is composed of 8 services, 3 infrastructures and 9 new 
growth engines. 8 services are WiBro (Wireless Broadband) Service, DMB 
(Digital Multimedia Broadcasting) Service, Home Network Service, Telematics 
Service, RFID-based Service, W-CDMA Service, Terrestrial Digital TV, and In- 
ternet Telephony (VoIP). 3 infrastructures are Broadband Convergence Network 
(BcN), Ubiquitous Sensor Network (USN), and Next-Generation Internet Proto- 
col (IPv6). And 9 new growth engines are Next-Generation Mobile Communica- 
tions, Digital TV, Home Network, IT System on Chip (SoC), Next-Generation 
PC, Embedded SW, Digital Contents, Telematics, and Intelligent Service Robot. 
The success of the Strategy will enhance the quality of our lives and bring us 
into ubiquitous society. 

But, with the advance of new services, intelligent devices such as telematics, 
home networking, and digital TV, the adverse effect of information society would 
become one of the major concerns in forthcoming information society. Users 
living in ubiquitous society propelled by IT839 Strategy will be very sensitive 
to security and privacy issues. We anticipate possible new information security 
threats. These are the diffusion of threats caused by network convergence, a sheer 
of collection and disclosure of personal information through pervasive devices, 
unestablished authentication framework for emerging transaction devices, and 
transition from the threats of the cyberspace into ones of the real world. 

If we fail to prepare for adequate and timely policies and related technical so- 
lutions to cope with such security and privacy challenges, IT839 Strategy would 
not be successfully implemented in our society. For IT839 Strategy to be suc- 
cessful, we need the proper security policies to overcome the anticipated threats 
of the future. First, to develop trustworthy convergent network, we will develop 
cryptography and authentication technologies for secure network connection, 
agent technology for rapid hand-off, and will standardize interface technologies 
for secure interoperability among different networks. Secondly, to ensure ubiqui- 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
© Springer- Verlag Berlin Heidelberg 2004 


>, pp. 430-14311 2004. 


Information Security in Korea IT839 Strategy 431 


tous service’s safety, we will establish safety criteria for new intelligent devices, 
develop lightweight cryptography technologies for privacy protection, and de- 
velop DRM (Digital Right Management) technologies for protection of illegal 
digital contents distribution. Lastly, we will improve legal system in preparation 
for the future IT environments, and will try to formulate security culture. 

It is obvious that a higher level of information security will be required to 
effectively sustain the ubiquitous society. For information security to be more 
effective, we should take not only technological countermeasures but also social 
and legal ones. MIC will try to build secure Korea by means of considering 
information security from the initial stage of IT839 Strategy implementation. 
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Abstract. Several generalizations of linear cryptanalysis have been pro- 
posed in the past, as well as very similar attacks in a statistical point 
of view. In this paper, we define a rigorous general statistical framework 
which allows to interpret most of these attacks in a simple and unified 
way. Then, we explicitely construct optimal distinguishers, we evaluate 
their performance, and we prove that a block cipher immune to classical 
linear cryptanalysis possesses some resistance to a wide class of general- 
ized versions, but not all. Finally, we derive tools which are necessary to 
set up more elaborate extensions of linear cryptanalysis, and to general- 
ize the notions of bias, characteristic, and piling-up lemma. 

Keywords: Block ciphers, linear cryptanalysis, statistical cryptanalysis. 


1 A Decade of Linear Cryptanalysis 

Linear cryptanalysis is a known-plaintext attack proposed in 1993 by Matsui 
[2T][22] to break DES [25], exploiting specific correlations between the input and 
the output of a block cipher. Namely, the attack traces the statistical correlation 
between one bit of information about the plaintext and one bit of information 
about the ciphertext, both obtained linearly with respect to GF(2) /j (where L 
is the block size of the cipher), by means of probabilistic linear expressions, a 
concept previously introduced by Tardy-Corfdir and Gilbert m- 

Soon after, several attempts to generalize linear cryptanalysis are published: 
Kaliski and Robshaw [T3] demonstrate how it is possible to combine several in- 
dependent linear correlations depending on the same key bits. In ED, Vaudenay 
defines another kind of attack on DES, called y 2 - at tack, and shows that one can 
obtain an attack slightly less powerful than a linear cryptanalysis, but without 
the need to know precisely what happens in the block cipher. Harpes, Kramer, 
and Massey [7] replace the linear expressions with so-called I/O sums, i.e., bal- 
anced binary-valued functions; they prove the potential effectiveness of such a 
generalization by exhibiting a block cipher secure against conventional linear 
cryptanalysis but vulnerable to their generalization. Practical examples are the 
attack of Knudsen and Robshaw m against L0KI91 and the one of Shimoyama 
and Kaneko [25] against DES which both use non-linear approximations. 

In [5], Harpes and Massey generalize the results of [7] by considering par- 
titions pairs of the input and output spaces. Let X = {X\, X %, . . . , X n } and 
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y = { 3 ?i, 3 ^ 2 j ■ ■ ■ ,y n } be partitions of the input and output sets respectively, 
where A) and y, are called blocks. The pair {X,y) is called a partition-pair 
if all blocks of X (respectively y) contain the same number of plaintexts (re- 
spectively ciphertexts). A partitioning cryptanalysis exploits the fact that the 
probabilities Pr [(X, ffe(X)) S (X, 3?)] may not be uniformly distributed for a 
block cipher fj, when the plaintext X is uniformly distributed. In order to char- 
acterize the non-uniformity of a sample distribution, Harpes and Massey con- 
sider two “measures” called peak imbalance and squared Euclidean imbalance. 
Furthermore, they observe on toy-examples that the latter seems to lead to 
more successful attacks. These results are completed by Jakobsen and Harpes 
in [THIIH] , where they develop useful bounds to estimate the resistance of block 
ciphers to partitioning cryptanalysis, with the help of spectral techniques; these 
bounds are relative to the squared Euclidean imbalance only, but this choice is 
not motivated in a formal way. To the best of our knowledge, the first practi- 
cal example of partitioning cryptanalysis breaking a block cipher is the attack 
known as “stochastic cryptanalysis” [M] proposed by Minier and Gilbert against 
Crypton [T71H5] , 

In recent papers, Junod and Vaudenay [HE] consider linear cryptanalysis in 
a purely statistical framework, as it was done for the first time by Murphy et al. 
[25] , for deriving optimal key ranking procedures and asymptotic bounds on the 
success probability of optimal linear distinguishers. A somewhat similar approach 
is chosen by Coppersmith et al. pQ, except that it is adapted to stream ciphers. 
One can note that tight results about optimal distinguishers allow furthermore 
to derive useful security criteria. 

Finally, the NESSIE effort resulted in a few papers investigating the power 
of linear (or non-linear) approximations based on different algebraic structures, 
like Z 4 . For instance, Parker m shows how to approximate constituent func- 
tions of an S-box by any linear function over any weighted alphabet. However, 
Parker observes that it is not straightforward to piece these generalized linear 
approximations together. In [25], Standaert et al. take advantage of approxima- 
tions in Z 4 by recombining the values in order to reduce the problem to the 
well-known binary case; they obtain more interesting biases comparatively to a 
classical linear cryptanalysis. 

Notation. Throughout this paper, random variables X.Y, . . . are denoted by 
capital letters, whilst their realizations x G X, y G y, . . . are denoted by small 
letters. The cardinal of a set X is denoted \X\. The probability function of 
a random variable X following a distribution D is denoted Pr □ [a;] or abu- 
sively Pr x [a;], when the distribution is clear from the context. For convenience, 
sequence X\,X 2 ,... , X n of n random variables is denoted X n . Similarly, a se- 
quence xi,X 2 , ■ ■ ■ ,x n of realizations is denoted x n . We call support of a distri- 
bution D the set of all x £ X such that Pr d [a;] /= 0. As usual, “iid” means 
“independent and identically distributed” . The transpose of a linear function h 
is denoted t h. 1a is 1 if the predicate A is true, 0 otherwise. Finally, denotes 
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the inner product. The distribution function of the standard normal distribution 
is denoted 



2 Optimal Distinguisher Between Two Sources 

In this section, we shall consider a source generating a sequence of n iid random 
variables Z n following a distribution D and taking values in a set Z. We wonder 
whether D = D 0 or D = Di (where Di is referred to as an “ideal distribution”), 
knowing that one of these two hypotheses is true. An algorithm which takes a 
sequence of n realizations z n as input and outputs either 0 or 1 is known as 
a distinguisher limited to n samples. It can be defined by an acceptance region 
A C Z n such that the distinguisher outputs 0 (respectively 1) when z n € A 
(respectively z n £ A). The ability to distinguish a distribution from another is 
known as the advantage of the distinguisher and is defined by 

Adv^ = |Pr D n[A]-Pr D n[A]| , 

which is a quantity an adversary would like to maximize. The distinguisher can 
make two types of mistakes: it can either output 0 when D = Dj or output 1 when 
D = D 0 . We denote a and 13 the respective error probabilities and P e = |(a + /3) 
the overall probability of error. We can assume without loss of generality that 
P e < §; we easily obtain that Adv^ = 1 — 2P e . 

2.1 Deriving an Optimal Distinguisher 

We describe here how to derive an optimal distinguisher for the scenario de- 
scribed below [TJ[TT]. Clearly, P e = | — | J2 z n eA (P r D" I 1 2 "] — P r D" [z"]), and 
therefore that the set minimizing P e is 

A = {z n E Z n : LR(z") > 1} where LR(z") = D ° [ — j (1) 

Pr D n [z n \ 

stands for likelihood raiic@. It defines an optimal distinguisher, i.e., with max- 
imum advantage given a bounded number of samples and with no assumption 
on the computational power of the adversary. 

In order to take a decision, a distinguisher defined by (|T]| has to keep in 
memory the results of the n queries, which is not feasible in practice if n grows. 
Fortunately, it is possible to derive an equivalent distinguisher with \Z\ counter 
values N(a|z"), each one counting the number of occurrence of a certain symbol 
a of Z in the sequence z n . We summarize this in the following result. 


1 Note that we could have equivalently chosen a strict inequality in fTJ . 

2 The likelihood ratio builds the core of the Neyman-Pearson lemma [2j-Ch. 12]. 
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Proposition 1 ( Optimal Distinguisher) . The optimal acceptance region to 
test D = Do against D = Di is Aopt = {z n £ Z n : LLR(z™) > 0} where 

LLR(z”) = £ N(«|z”)logg&|| 

s.t. N(o| Z ”)>0 

is the logarithmic likelihood ratio, with the convention that log ^ = — oo and 
log g = +oo (the log g case can be ignored), and where N(a|z") is the number 
of times the symbol a occurs in the sequence z" £ Z n . 

Given the number of realizations n, we can compute the exact advantage of 
the optimal distinguisher. Let [D 0 ] n and [Di]" be the vectors defined by 

22 , •• -,z„) = Pr D? [zi,z 2 , ■■■An) with | € {0, 1} , 

which are a specific case of n-wise distribution matrices of the Decorrelation 
Theory [35] in a simplified case as we have no input here, only outputs z*. The 
probability that the distinguisher outputs 0 when D = Dj is J2z n e,J Di]S», 
for j £ {0,1}. The advantage is thus \Y) z « eA ([D 0 ]2n — [D-|]”„)|. Since A op t 
maximizes the sum, we obtain 

Adv A, pt = \ II [D 0 ]”-[D 1 ] n ||i , 

where the norm || • ||i of a vector A is defined by || A ||i= JT A, \ . Note that 
the statistical framework of Coppersmith et al. [T] is based on this norm. 


2.2 Complexity Analysis 

In this section, we compute the number of queries the optimal distinguisher 
needs in order to distinguish Do from Di, given a fixed error probability P e . 

Definition 2. The relative entropy or Kullback-Leibler distance between two 
distributions D 0 and D , is defined as 

"(Doll D >) = |>°.Ml 08 ^) . 


with the convention that 0 log | = 0 and plog g = +oo for p > 0. 

We will refer to this notion using the term relative entropy as, being non- 
symmetric, it is not exactly a distance. Nevertheless, it is always positive since 
— log is convex. Using this notation, the following proposition can be proved. 

Proposition 3. Considering that Zi,Zs,.. . is a sequence of iid random vari- 
ables of distribution D and that Dq and Di share the same support, 


Pr |~ LLR(Z ra ) - np < 1 


m , ( 2 ) 
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assuming that /a = pj with po = -D(D 0 || Di) > 0 and p\ = — £>(Di || D 0 ) < 0, 
and that a 2 is 

CT i 2 = H Pr D, W ( l0 s Pr d! [l] ) “ ^ ’ (3) 

when D = for j e {0, 1}. 


Proof. We first note that the logarithmic likelihood ratio can be expressed as a 
sum LLR(Z") = /{j d lln where 


R i = 'Z 1 *=* 

zez 


Pr Do [Z] 

Pr Di [■*]. ’ 


where every Z i: follows distribution Dj (so that the Rfs are iid). The Central 
Limit Theorem then states that Pr [(LLR(Z n ) — npj)/ (ojyUi) < t] converges 
in distribution towards where pj = Ed 3 [R] and ffj 2 = Varo,, [R,;]. Some 
straightforward computations lead to the announced result. Note that the as- 
sumption that both distributions share the same support is necessary for pj and 
Oj to be well defined. □ 


We now assume that the distributions D 0 and Di are close to each other, 
since it is the usual encountered case in practice. 


Assumption 4. Considering that Do is close to Di, we can write 

Mz e Z : Pr d 0 [*] = Pz + e* and Pr Dj [ z ] = p z with \e z \ <C p z ■ 

Note that in such a case we can approximate LLR (z n ) by ^ n ^( a l Z ") e a/Pa- 
Proposition [3] can now be simplified using Taylor series. 


Proposition 5. Under the hypothesis of Proposition^ and of Assumption^we 
have, at order two: 

Mo w -p! w ^ ^2 — and ct 0 2 w ui 2 « ~ ■ 

Z zez Pz zez Pz 

We can finally derive a heuristic theorem giving the number of samples the 
distinguisher needs, together with the implied probability of error, in order to 
distinguish close distributions with same support. 


Theorem 6. Let Z \, . . . , Z n he iid random variables over the set Z of distribu- 
tion D, Do and Di be two distributions of same support which are close to each 
other, and n be the number of samples of the best distinguisher between D = Do 
or D = Di . Let d be a real number such that 

d - (4) 

2R( Do || D,) 1 J 

zez^ z 

(where p z = Proi [ 2 ] and p z + e z = Pro 0 \ z \)- Then, the overall probability of 
error is P e w $(— Vd/2). 
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Proof. If d is such that ft = \\fdjn d, where fi and d respectively denote 
the approximation of po and oq at order 2, we obtain (j4|). By definition P e = 
|{1 — Pr Dl [LLR < 0] + Pr Do [LLR < 0]). However 


Pr Di [LLR<0] = Pr D . 


[ LLR — rifij y/rifij 

ajy/n aj 



where we make the usual approximation that the left hand side of © can be 
approximated by i>(t). Therefore, as Proposition [Instates that po ~ —p\ w fi and 
that cr 0 « (Ti « <7, we have P e « | fl — <fr(\/d/2) + $(— \/d/2)j = $(— \/d/2). 


Note that it may be possible to obtain strict tight bounds instead of an 
approximation for P e using, for instance, Chernoff bounds. 


2.3 Case Where the Ideal Source Is Uniform 

From now on, we assume that D x is the uniform distribution. When D 0 is a 
distribution whose support is X itself and which is close to D x , Theorem [S] can 
be rewritten with 

d 

"T *l£d ' 

zez 

This shows that the distinguishability can be measured by means of the 
Euclidean distance between D 0 and D x . In the very specific case where Z = 
{0, 1}, we have eo = — e x = e and one can see that n is proportional to e~ 2 . It is 
a well accepted fact that the complexity of linear cryptanalysis is linked to the 
inverse of the square of the bias [3T] which is, as we can see, a consequence of 
Theorem [6] We now recall what appears to be the natural measure of the bias 
of a distribution, considering the needed number of samples and Assumption 0J 

Definition 7. Lete z = Pr d 0 The Squared Euclidean Imbalanc^l fSEIj 

A(D 0 ) of a distribution D 0 of support Z from the uniform distribution is defined 
by 

A(D 0 ) = |-Z|E e * ■ 

*e.z 

It is well-known (see [tjUTT] 1 that a \ 2 cryptanalysis needs O(l/A(D 0 )) queries 
to succeed, which is by no means worse, up to a constant term, than an optimal 
distinguisher. Junod observed El that a x 2 statistical test is asymptotically 
equivalent to a generalized likelihood-ratio test developed for a multinomial dis- 
tribution; although such tests are not optimal in general, they usually perform 
reasonably well. Our results confirm this fact: a cryptanalyst will not loose any 


3 Although this appellation coincide with the one of [7], note that the definitions 
slightly differ. 
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essential information in the case she can describe only one of the two distribu- 
tions, but the precise knowledge of both distributions allows to derive an optimal 
attack. In other words, when it is impossible to derive both probability distri- 
butions, or when an attack involves many different distributions and only one 
is known, the best practical alternative to an optimal distinguisher seems to be 
a x 2 attack, as proposed in m- This fact corroborates the intuition stipulating 
that x 2 attacks are useful when one does not know precisely what happens in 
the attacked block cipher. 

2.4 Case Where the Source Generates Boolean Vectors 

We assume here that random variables are bitstringfl, so that Z = {0, l} e . 

Definition 8. Following the notations of Assumption^ let Do be the distribu- 
tion defined by the set {e z } ze z, Di being the uniform distribution on Z. We 
define the Fourier transform of Do at point u £ Z as 

*. = £(— i )“■***• (5) 

zez 

The involution property of the Fourier transform leads to 

■."sD-Ti- (6) 

uez 

The next property can be compared to Parseval’s Theorem. 

Proposition 9. In the case where Di is the uniform distribution over Z = 
{0, 1} ( , the SEI and the Fourier coefficients are related by: 

A{D 0 ) = Y j ^u ■ 

uez 

We now recall the definition of the linear probability [23], which plays a 
central role in the context of linear cryptanalysis. 

Definition 10. The linear probability of a boolean random variable B is 
LP (B) = (Pr \B = 0] — Pr [B = l]) 2 = (2Pr [B = Q]~ l) 2 = (e [(-1) b ] ) 2 . 


Proposition 11. Let Z = {0,1}^. If Z £ Z is a random variable of distribution 
Do, the SEI and the linear probability are related by: 

Z\(D 0 ) = Y, LP ( W ' Z ) ■ 

wez\{ o} 


4 Note that all the study below extends in a straightforward way to Z = GF(p)* for 
a prime p by replacing (—1) by e * and by using the conjugates of e z and e* in © 
and © respectively. For simplicity we restrict ourselves to GF(2). 
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Proof. By using ([5) we have e u = Ed 0 [(— l) u ' z ] — l u= o- Proposition [5] gives 

^(Do) = E„ ez \ {0} ( e do [(-i )“’ z ]) 2 = E m 6 z\ { 0 } Lp (“ ' ^)- □ 

Corollary 12. Let Z be a random variable over Z = {0, 1}^ of distribution Do 
and feU be the maximum of LP(w • Z) over w £ Z\ {0}. We have 

A(D 0 ) < (2*-l) LP^ ax . 

Theorem [5] and Corollary [T5] together mean that the complexity of the best 
distinguisher between two distributions of random bit strings can decrease with 
a factor up to 2 f - when compared to the best linear distinguisher. It is interesting 
to note that there are cases where this bound is tight. For example if D 0 is such 
that Pr d 0 \z\ is + (l — 7 if z = 0, and ^ — ^7 otherwise (where 7 is a 
positive constant), it can be shown that LP(w • Z) = 7 2 for all w f= 0. Hence 
A(D 0 ) = (2* - 1)7 2 and LP max = 7 2 . 

2.5 Statistical Distinguishers 

In the last section, we have been trying to distinguish two random variables 
following two distinct distributions in a set Z = (0, 1 Y where i should not be too 
large from an implementation point of view. If we try to distinguish two random 
variables distributed in some set {0, 1} L of large cardinality (e.g. where L = 128), 
we won’t be able to implement the best distinguisher of Proposition Q] as the 
memory requirement would be too high. Instead, we can reduce the source space 
to a smaller space Z = (0, 1}^ by means of a projectior^ h : {0, 1} L —> Z defining, 
for a random variable S £ {0, 1} L of distribution D, a random variable Z = h(S) 
of distribution D. Here we consider that h is a balanced function and that Di is a 
uniform distribution, so that Di is a uniform distribution as well. This is a typical 
construction in a real-life block cipher cryptanalysis, where the block length is 
quite large. Now, even though we know which distinguisher is the best to use in 
order to distinguish Do from Di, it is still not clear how the projection h has to be 
chosen. Probably the most classical example arises when l = 1 and h(S) = a - S 
for some non-zero a £ {0, l} e . We then talk about a linear distinguisher. In 
this case, we note that zA(D 0 ) = LP(a • S) < LP®^. Modern ciphers protect 
themselves against that type of distinguisher by bounding the value of LP® ax . 
A natural extension of the previous scheme would be to consider any linear 
projection onto wider spaces, e.g. to consider h(S ) £ Z = { 0, 1 Y (where t > 1 
is still small) such that h is GF(2)-linear. We then talk about an extended linear 
distinguisher. It seems natural to wonder about the complexity gap between 
linear cryptanalysis and this extension. The following theorem proves that if 
a cipher provably resists classical linear cryptanalysis, it is (to some extent) 
protected against extended linear cryptanalysis. 


5 We make a slight abuse of notation since LPf iax is not a random variable depending 
on Z, but a real value depending on the distribution of Z. 

6 We borrow this appellation from Vaudenay m the same expression is used within 
Wagner’s unified view of block cipher cryptanalysis [33] as well. 
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Theorem 13. Let S be a random variable over {0, 1} L . Whenever the source 
space is reduced by a projection h : {0, 1} L —* {0, l} e in a GF(2 )-linear way, we 
have A(h(S)) < (2 ( - l)LP® ax . 

Proof. We use Proposition HT1 and the fact that w ■ h(S) = t h(w) ■ S. □ 

A classical example of a linear space reduction arises when considering con- 
catenation of several projections. For example, denoting = hW(Do) for 
i £ {1 ,...,£} where ftW : {0, l} 1, — *■ {0,1} is linear, we consider h(S) = 
(hP-\S ), . . . , h^(S)). This corresponds to the works of Kaliski and Robshaw 
[13] (where different linear characteristics involving identical key bits axe merged) 
and of Junod and Vaudenay [T2] (where different linear characteristics involving 
different key bits are merged). In the latter situation, if no assumption is made 
about the dependency among the Z\(D^)’s, Theorem [Till tells us A(D^ x ■ • • x 
Dq ) < (2 e — l)LP alax . The following proposition tells us what happens in gen- 
eral when the Dq*' 1 ’s are independent but do not necessarily come from a linear 
projection nor a Boolean projection. 

Proposition 14. Consider the case where D 0 = x • • • x . If Dq 1 - 1 , . . . , 
are independent distributions, then A(D 0 ) + 1 = nf=i (a(Dq^) + lj . Therefore, 
A(D 0 ) can be approximated by the sum of the A(D^) ’s. 

Proof For the sake of simplicity, we restrict this proof to the case where Do = 
Dq°^ x Dq 6 ' 1 . Let Z = (A, B) where A and B are two independent random variable 
following distributions D^ and D^ respectively. As in Proposition [TT] we have 

^ a) x D®) = £ (E [ ( _i r ^-B]) 2 

(o,h)6Z 2 \{0} 

= E (E[(-iri) 2 (E[(-ir B ]) 2 

= (d(D<°’) + l) (A(Df ) + l) - 1 . 

□ 

This result tells us that merging I independent biases should only be consid- 
ered when their respective amplitudes are within the same order of magnitude. 

In the light of the preceeding discussion, the cryptanalyst may wonder if it 
is possible to find a distinguisher with a high advantage even though the value 
of LP aiax is very small. We provide an example for which it is indeed the case. 

Example. Consider a source generating a random variable S = (Xi, . . . ,X n+ x) £ 
Z 4 +1 , where n is some odd large integer, and we represent Z 4 by {0, l} 2 in binary. 
Here we have L = 2n+2. If the source follows distribution Do, then Ad, . . . , X n £ 
Z 4 are uniform iid random variables and X n+ i = (Y + Y^i=i Xi) mod 4, where 
Y £ {0, 1} is a uniformly distributed random variable independent of Ad , . . . , X n . 
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If the source follows distribution Di, S e Z% +1 is uniformly distributed. It can 
be shown (see Annendix IXjl that LP alax = On the other hand, if we 

let h : Z4" 1 " 1 — *• Z 2 be such that h(S) = msb ((X„ +1 — Y^=o A) m °d 4) (where 
msb stands for most significant bit), we have i = 1 and a SEI equal to 1, so that 
A(D 0 ) LP aiax : D 0 can be distinguished from Di despite LP; aax is small. 

This example shows that Tlieoremll. 'll tells us nothing about the SEI whenever 
the plaintext space is reduced by a non-linear projection. Therefore, even though 
IP max is very low, there may exist some tricky non-linear projections which lead 
to significant breakdown of the complexity of distinguishers, i.e., there may be 
something beyond linear cryptanalysis. 

3 Optimal Distinguisher Between Two Oracles 

So far we discussed how to distinguish random sources. Now we investigate 
applications for distinguishing random oracles, such as block ciphers, and how 
to transform this into the previous problem. 

We consider the random variable Z taking values in Z to be a couple of ran- 
dom variables (X, Y) taking values in X x y. As discussed in Sect. 12.51 the couple 
(X, Y) can be seen like the image of a plaintext/ciphertext couple (P, C) by some 
balanced projections <p and ip (which actually define the statistical cryptanalysis 
in use); in other words, the adversary queries the oracle for known-plaintext pairs 
and compute the projections <f> and ip to sample (X, Y). For simplicity reasons, 
we focus our study on known-plaintext attacks (such as linear cryptanalysis) 
and thus, we consider that X is uniformly distributed. The distribution of Y is 
defined by a transition matrix T such that 

[T] x , y = Pr [T = y\X = x] = Pr \ip(C) = y\cp(P) = x] . 

The transition matrix T can either be T 0 or T 1 , where T 1 is the uniform 
transition matrix (i.e., [T \\ x , y = y-py). The distribution D of Z depends on the 
transition matrix T. We will denote it Do (respectively Di) when T = Tq (re- 
spectively T = T 1 ). We can see that if T = T\, as X is uniformly distributed, 
the distribution Di of Z is also uniform. Therefore, all the results presented so 
far can be applied to the particular case we study here. Indeed, if we note that 

Pr D [z] = Pr [X = x,Y = y] = [T] x>v Pr [X = ®J . 

We can express Proposition Q] in terms of the transition matrices. 

Proposition 15 ( Optimal Binary Hypothesis Test with Transition Ma- 
trices). The optimal acceptance region to test D — D 0 against D = Di (where 
Di is the uniform distribution), that is to test T = Tq against T = T\, is 


Apt = {(x n ,y n ) e X n x y n : LLR(x n ,y n ) > 0} 


442 T. Baigneres, P. Junod, and S. Vaudenay 


where 

LLR(x",y ra ) = Y, N((*,y)|z»)logfj^ 

(x, y )exxy ^ 

S .t. N((x,y)\z n )>0 

with the conventions used in Proposition QJ 

In the next sections, we derive the complexity of this distinguisher, discuss 
the relationship between our model and previous work, and study how Matsui’s 
Piling-up Lemma m extends to our model. 

3.1 Cryptanalysis Complexity 

We introduce the notion of bias matrix B = T 0 —T i. Note that Yl x ex{B\x,y = 0 
when X is uniformly distributed and that Ylyey[B\x,y = 0 in any case. Similarly 
to Definition 0 the Fourier transform B of the bias matrix B is such that 

[ b] uv = E (-ir* 0 ^[su . 

u ' v (x, y )exxy 

Furthermore, we define LPM, the linear probability matrix, by [LPM] u v = 0 
if u = v = 0 and by [LPM], u v = LP(u • X © v ■ Y) otherwise. It can be noted that 

[b] = \X\ 2 [LPM]. u v . With the notations we just introduced, it is possible to 

derive the complexity of the best distinguisher between two oracles as a simple 
consequence of Theorem [5] and of Proposition [TTJ 

Proposition 16. Let n be the number of queries of the best distinguisher be- 
tween T o and T i, which are supposed to be close to each other and of same 
support. Then the overall probability of error is P e ~ 1 — <fr(Vd/ 2), where d is a 
real number such that n = d/A(Do). Furthermore, as 

zi(D 0 ) = M || B ||| = Jp || B ||| = Y t LPM k» . 

1 1 \ X \ ( u,v)exxy 

n can be equivalently expressed in terms of the bias matrix, of its Fourier trans- 
form, or of the linear probability matrix (and thus, of the linear probabilities). 

Matsui’s linear expressions are a very particular case of the transition matri- 
ces we have defined at the beginning of Sect. [3] Indeed, choosing balanced linear 
projections : {0,1} L — » {0,1} is equivalent to choose input/output masks 
on the plaintext/ciphertext bits. The respective shapes of the corresponding bias 
matrix, of its Fourier transform, and of the LPM matrix are 

B =(-«") ' S= (o4e) LPM =(!k) • 

where e is nothing but the bias of Matsui’s linear expressions. According to 
Proposition [TSJ we see that the complexity of the distinguishing attack is pro- 
portional to || B || f 2 , which is a well known result in linear cryptanalysis, for 
which || B ||1= 4e 2 . 
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pH) _ 

c, 1 

p( 2) _ 


Fig. 1. Two rounds of an iterated block cipher 


There is an intuitive link between linear probability matrices and corre- 
lation matrices (3] . Recall that the correlation matrix of a Boolean function 
/ : {0,1}" — *• {0,l} m is the 2 m X 2" matrix such that = 

2Pr [u ■ f(P ) 8 v ■ P] — 1, where the probability holds over the uniform dis- 
tribution of P, so that [CWj* = LP(u • /(P) © v ■ P). We see that correlation 
matrices are strongly related to the linear probability matrices in the specific 
case where <j> and 8 are identity functions (i.e., no reduction is performed on the 
plaintext space). 

3.2 Piling-Up Transition Matrices 

A distinguishing attack on an iterated cipher is practical on condition that the 
cryptanalyst knows a transition matrix spanning several rounds. In practice, the 
cryptanalyst will derive a transition matrix on each round and, provided that 
the projections were chosen carefully, pile them in order to obtain a transition 
matrix on several rounds of the cipher. 

We consider the scenario where a block cipher is represented by a random 
permutation C over {0, 1} L (L denotes the block size of the cipher), where the 
randomness comes from the key. Moreover we suppose that the block cipher is 
made of two rounds corresponding to the succession of two random permutations 
C} 1 ) and C^ 2 ). In other words C = C*- 2 ^ o C^. We denote pWjPf 2 ) g {0, l} 1, 
the respective inputs of and C (2) , whereas P^ 3) denote the output of C( 2 \ 
The random variables X, W, and Y respectively denote (p(P < ' 1 ' 1 ), £(P( 2 )), and 
-0(P( 3 ) ) , where 0, £, and ip are projections onto X, W, and y, respectively. With 
these notations, the respective transition matrices of C^, C^ 2 \ and C are 

[r (1) ] xw = Pr^pcM*] , [T^] wy = Pv Y \ w [y\w] , 

and [ T ]x,y = Pr UX [y I X ] • 

This situation is represented on Fig. [TJ Note that we use a representation 
which is very similar to Wagner’s commutative diagrams [M]. Under the as- 
sumption that X <-> W Y is a Markov chain (as in [51]), it can easily be 
shown that successive transition matrices are multiplicative, i.e., T = T ^ xT^K 
Note that this situation is idealistic as, even under the classical assumption that 
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p(i) p(2) p(3) is a Markov chain QSJCI2], X W *-+ Y may not be a 

Markov chain unless the projection are chosen with care. Nevertheless, under 
the suitable suppositions, the following lemma shows how the Piling-Up Lemma 
extends to our model. 

Lemma 17. Let B^\ B^ 2 \ and B be the bias matrices associated with TW, 
T^ 2 \ and T respectively, such that T = T W x T^ 2 \ In_the case^of a known- 
plaintext attack, B = B 1 ' 1 ' 1 x B ( ‘ 2 ' 1 and B = JL B (i 'i x B ( ‘L . Therefore, 

II B ||| < || B W ||| || B ^ ||| , with equality if, and only if we can write 
= a x ^ w and = TwPy, for some a 6 (3 G and 

7 G Rl-T 

Proof. As T = T (r > x T (2 \ we have 

[B| « - - w - £ (KL + r) (M„ + wi}~wr 

As T, w [B {1 \ w = 0, we obtain [B] x<y = x B^] x y + ^ ^ [fl (2) L, y - 
The fact that P 1 ' 1 ' 1 is uniformly distributed implies that P^ and P^ are uni- 
formly distributed and thus, as 0, £, and ip are balanced, that X, Z, and Y are 
also uniformly distributed. In that case, we know that [* (2) U = 0. 

which proves that B = B (l '> x B^K We also have 

[BW x jjM] = [b^] [-^ ) ] 

W,V new 

= E [^ (1) ] [s (2) ] ; e (-ir ( “® w ' ) 

(x,w)eXxw x,w w ,v «ew 

(w’, y )ewxy 

= |W| e Hr*®*' 3 ' E [ B(1) ] [ B(2) ] 

(x,y)£Xxy w&W X ’ W W,V 

= iwi E (-i r mv - y [B] X}V 

( x, y )exxy 

= m[s\ utV > 


which proves that B = x B^ 2 P Finally, from Cauchy-Schwarz inequality: 

(e [ B<i, u B<2) L,„y 

\wew ’ ’ / 

[ek.)(e 


|| BW x B™ ||2 = £ 

(* ,v)exxy Ww " 


s E 

(: x,y)eXxy \»£W 

= II BW III II B^ III , 
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with equality if, and only if, for all x, y £ X x y there exists some \ XiV such that 
[B (1) ]* l10 = \ XtV so that [BW]^ = A X)0 = a^ w . Taking 

/ 3 y equal to ao /Xo,y when Ao, y /= 0 and to zero otherwise leads to the announced 
result. □ 

How to find projections cj), tp and £ on larger spaces exhibiting such a Marko- 
vian property in a given block cipher remains however an open question to us. 
We may hope to approximate such a Markovian process. 


4 Distinguishers Versus Key Recovery 

In this section we show that our framework can adapt to key recovery instead of 
distinguishers. Let us consider a process which generates independent random 
variables Z^k, • • • , Z„k depending on some key K £ {0, \} k . We assume that 
for one unknown value K = Kq all Z^k ' s follow distribution Do, whereas when 
K /=Kq all Z^K s follow distribution Di. We consider the simple key ranking 
procedure which, for all possible K e {0, l} fe , instantiates z'^ and ranks K ac- 
cording to the grade Gjf = LLR(z^). For any K /=Kq we obtain (similarly to 
what we had in Theorem |SJ) that G^ 0 — G k is approximatively normally dis- 
tributed with expected value nz4(D 0 ) and standard deviation y/2nA{Dq). Hence 
we obtain Gjf 0 < G k (i-e., a wrong key K has a better rank than the right key 
K 0 ) with probability approximatively $ ^—y/nA( D 0 )/2^. Let d be such that 
n = d/Z\(D 0 ). This probability becomes $ (^—y/d/2 S j which is approximatively 
e _d//4 /v / 27r when d is large. So K 0 gets the highest grade with probability ap- 
proximatively equal to (l — e~ d / 4 /\/27r) 2 1 w exp (— 2 fe • e^ d ^ 4 / V2 tt) , which is 

high provided that d > Ak log 2. Hence we need 

^ 4fclog2 

n -*wr 

This formula is quite useful to estimate the complexity of many attacks, e.g. 
[imreqfl We can finally note that the expected rank of K 0 (from 1 up to 2 fe ) is 
l + (2 fe -l)$(-^/n^(D 0 )/2). 


5 Conclusion 

Most modern block ciphers are proven to be resistant to linear cryptanalysis in 
some sense. In this paper, we wonder how this resistance extends to (both known 
and unknown) generalizations of linear cryptanalysis. For this, we define a sound 


7 Note that [T5]|30] use slightly different notations: zA(Do) denotes the Euclidean Im- 
balance instead of the Squared Euclidean Imbalance. 
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and rigorous statistical framework which allows us to interpret most of these 
attacks in a simple and unified way; secondly, we develop a set of useful statistical 
tools to describe such attacks and to analyze their performance. Recently, our 
results on GF(2)-linear projections were exploited by [5U] to obtain a small 
improvement factor in an attack on EO, and by m in another attack against 
two-level EO [T3]. In the sequel of this paper, we observe that resistance to 
linear cryptanalysis implies (a somewhat weaker) resistance to generalizations 
based on GF(2 ) -linear projections; however this resistance does not extend to all 
statistical cryptanalysis, as demonstrated by our example exploiting correlations 
in Z 4 , which confirms observations of Parker and Standaert et al. [571 [Ml- The 
next natural step, which we hope to have rendered easier, will be to exhibit 
such a practical statistical cryptanalysis against a block cipher immune to linear 
cryptanalysis, like AES [4]. 
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A A Strange Distribution 

We consider a source generating a random variable S = (Xi, . . . , X„ +1 ) e ZJ+ 1 , 
where n is some large integer, which follows either Do or Di (the uniform distribu- 
tion). The distribution D 0 is such that the X\, . . . X n are uniformly distributed 
iid random variables and X n+ \ = (Y + ^"=i X) mod 4, where Y G {0, 1} is 
uniformly distributed and independent of X, . . . , X n . We claim that the linear 
probability of the best linear distinguisher with one query is very small (equal 
to 2-("+b) whereas it is still possible to find a projection h such that Z = h(S) 
has a high SEI. In order to simplify the proof, we will suppose that n + 1 is a 
multiple of 4. 

Proposition 18. Let h : Z^ +1 — > X be defined by 

h(S) = msb {(X n+1 - Xi) mod 4). Then the SEI of Z = h(S) is 1. 

The following lemmas will be used to prove that the best linear distinguisher 
is drastically less powerful than the distinguisher of Proposition IT8l 

Lemma 19. Let u = U\U 2 ■ ■ ■ u n be a string of n bits. If we denote w the Ham- 
ming weight of u then we have 

E w(w — 1) 

UjU k = ^ • 

l<j<k<n 


How Far Can We Go Beyond Linear Cryptanalysis? 449 


Lemma 20. For any positive integer N, we have: 

LJV/4J / N\ 1 

£ ( 4j )= j( 2JV + &t^ + ^-^n and 

L(iV-l)/4j 

E ( 4J + 0 = 5 + 4 ! - *)") ■ 

where i is the imaginary unit equal to ^/ = T. 

Proposition 21. When S follows D 0 we have LP^ ax = 2~^ n+r> . 

Proof. Each X, is in Z 4 so that it can be described by two bits, denoted XfX\. 
If S is considered like a bit string, a linear distinguisher will be defined by a hash 
function h such that 


h(S) = 




where oi,..., a n+ i,bi , . . . , b n+ 1 e {0, 1} with at least one 
easily prove that 


non-zero value. We 


Xn+1®Y = ® Xj and X r H + 



Thus, if B denotes the value of the bit h(S), we have 


B — j ® a n+ i)Xf J ® j ® b n+ {)Xf j ® a n+ iF 

® -y L xA ® (<>„+!© vy 


If b n+ 1 = 0 we can see that (as at least one of the oi, . . . , a n+ i, b \, . . . , b n is 
strictly positive) Pr d 0 [B = 0] = hence LP(_B) = 0. If b n+ \ = 1, we have 


B = 




© 



a n +i 


Y 
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If one of the bj’s is non-zero, then B is uniformly distributed so LP(B) = 0. 
We now assume that bj = 1 for all j 1 ..... n. We have 


B= ©(«,ea„ + ,)Xj- 


©*P" ■ 


Let us define Uj = Xj 1 ® a ® aj for j G {0, . . . , n} and Uj = Y ® a for j = n + 1, 
with a = a.j. We can show that 

0 u,u k 

\<j<k<n+\ 

where c £ {0, 1} is a constant. Using Lemma HU1 and denoting W the Hamming 
weight of the random string of bits U\, . . . , U n+ 1 we obtain 


Pr [B = c] = Pr 


| W(W-1) 


= 0 (mod 2)J = Pr [W mod 4 = 0 or 1] 
L5J . 


- _L V ( n + A _J_ V- ( n + 1 \ 

- Z. ^ 4 j J + 2 n+1 Z. \ 4 .j + x) ' 

Using Lemma [201 we deduce 

Pr |B = c , = i + (i+ii^Ki^r = i = i + Mf: 

^ 2 ‘ 4x2" 2 ^ 2 tt +1 2 T 2 ^ 

where we used the fact that n + 1 is a multiple of 4. Finally, LP® ax = 2 
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Abstract. In this paper, we introduce a new power analysis attack 
against DES. It is based on the well known Davies-Murphy attack. As 
for the original attack, we take advantage of non-uniform output distri- 
butions for two adjacent S-boxes. We show how to detect these biased 
distributions by power analysis on any DES inner round and thus obtain 
one bit of information about the key. 

An advantage of this new attack is that no information about DES 
inputs or outputs is required. Therefore it is likely to defeat many actual 
countermeasures, in particular the popular masking techniques. 


1 Introduction 

Side-channel attacks have been developed in parallel to “classi cal” at tack tech- 
niques since about 10 years. The initial publication by Kocher lll3, 14l of Simple 
Power Analysis (SPA) and Differential Power Analysis (DPA) has been a ma- 
jor breakthrough in the domain. The general idea in this new family of attacks 
is to use “non-conventional” sources of information. Typically, the situation is 
we have a cryptographic device manipulating secret key or data which is pro- 
tected against physical intrusion (we can think of this device as a smart-card, 
for instance). Then an attacker tries to obtain these secrets by measuring some 
external elements of information about the device. A leakage can result from the 
electric consumption of the device, its electromagnetic radiations, or simply by 
timing measurements. Some related attacks are also based on analyzing faults 
during the execution of the cryptographic computations [8]. 

Side channel attacks using the electric consumption are generally called 
“Power Attacks” . It is widely believed that power consumption is always some- 
how correlated to the manipulated data. The question is thus to find appropriate 
countermeasures in order to thwart all known attacks. Power Attacks have been 
developed without distinction to secret and public key primitives. However in this 
paper, we mostly focus on the analysis of block ciphers. In this particular con- 
text, the most popu lar fam ily of attacks are DPA [[14] and its extended version, 
Higher-Order DPA ll7l 2lH . Advanced attacks usually revisit some techniques of 
“classical” cryptanalysis, like collision attacks [20| or differential attacks EH- 

The goal of this paper is to propose a new power attack. We revisit the well- 
known Davies-Murphy cryptanalysis of DES (5}|ll[ and transform it into a power 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 3329, pp. 451-|467| 2004. 
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analysis attack. The “classical” attack uses non-uniform output distributions for 
each pair of adjacent S-boxes in DES. This property results from the duplication 
of some state bits by the expansion function. Non-uniform distributions result in 
detectable imbalance in electric consumption, and we propose several techniques 
to detect and exploit this imbalance. We call our new attack the Davies-Murphy 
Power Attack (DMPA). 

First we discuss the model used to describe the correlation between interme- 
diate data and power consumption. Then we recall the principles of DES, the 
Davies-Murphy attack and investigate some additional properties. In SectionOU 
the general principle of DMPA is exposed and we propose some tricks to apply 
it to various scenarios and different kinds of implementation. The final sections 
are dedicated to discussing the advantages and the extensions of DMPA. 


2 The Power Consumption Model 

In power analysis attacks, the basic assumption is that power consumption is 
somehow correlated with some data handled during the execution of an instruc- 
tion. A classical assumption is the Hamming weight model 09] where we 
suppose that the power consumption is proportional to the hamming weight of 
the manipulated data D. Let W be the power consumption and H the hamming 
weight function. We suppose that 

W = A H(D ®R) + 6 

where 6 is a term of noise, A a scalar and R a reference state from which we 
measure the number of bits flipped. For instance, R is often seen as a constant, 
unknown machine word (but R is not necessarily zero) . The underlying assump- 
tion for electric consumption is that flipping a bit from 0 to 1 or flipping it from 
1 to 0 costs almost the same thing, while keeping a bit unchanged costs almost 
nothing. 

Many papers on side channel attacks [7j |l0l|l4|[l8] observed empirically this 
correlation between the consumption of a smart card and the hamming weight 
of the operands. This model has also been verified more formally (see 0 for 
instance). Although a finer analysis has revealed that an extended linear model 
was sometimes more appropriate [l], it is still widely believed in practice that the 
Hamming weight model is a reasonable approximation. Actually it seems partic- 
ularly well suited to model circuits based on the widely used CMOS technology, 
while it may be less appropriate for other technologies. 

In the following, we suppose that the Hamming weight model is verified. We 
stress out that this model is not specifically helpful for our attack. We choose it 
because it is frequently used in the literature, and from our experience of cryp- 
tographic hardware, we believe it is very often appropriate. However our attack 
could probably be adapted to another model, as long as an actual correlation 
exists between W and D. 

It is classically known that implementations can be subject to power analysis 
attacks when one of the following condition holds : 
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— the intermediate data D depends only on the plaintext and a small portion of 
key bits. This is the fundamental hypothesis for Differential Power Analysis 
(DPA). 

— a simple function of several intermediate data D\ . . . . . D t depends only on the 
plaintext and a small portion of key bits. This is the fundamental hypothesis 
for Higher-Order Differential Power Analysis (HO-DPA) 1 . 

Then an attacker would use the correlation between intermediate data and 
power consumption to detect a correct guess of the key bits. Recent implemen- 
tations take into account this threat by protecting all inner instructions. For 
instance a popular family of countermeasures consists in masking the manip- 
ulated data El- The underlying idea is that intermediate values should look 
random, even when the plaintext is known. However, most countermeasures do 
not take into account the fact that intermediate data may be biased indepen- 
dently of the plaintext. In the case of DES, this is actually the case because 
of Davies’ observation about pairs of adjacent S-boxes |ll] . In the next section, 
we focus on DES and recall the well-known Davies-Murphy attack. 


3 DES and the Davies-Murphy Attack 

The Data Encryption Standard (DES) is one of the most popular block cipher. 
Since it was selected as a standard by the NBS in 1977 |1§, it has been the 
target of many research on cryptanalysis. Among all the results against DES, 
three attacks have emerged : 

— Differential Cryptanalysis (DC) [g] was proposed by Biham and Shamir in 
1990. It has been a major breakthrough and many applications to other 
algorithms have been demonstrated thereafter. Since then, it was revealed 
that the principle of DC was already known by the designers of DES. 

— Linear Cryptanalysis (LC) flj)] was proposed by Matsui in 1993. Like DC, 
it became quickly very popular and was applied successfully to other algo- 
rithms. In addition, this attack was practically implemented by Matsui in 
the case of DES. This technique was presumably not known by the designers 
of DES. 

— The Davies-Murphy Cryptanalysis 00 is a dedicated attack against DES. 
It takes advantage of biased distributions for two adjacent S-boxes. Although 
less generic than the previous two, Davies-Murphy cryptanalysis is a concern 
for Feistel ciphers with a non-bijective round function. 

First we remind the general structure of DES (see Figure 1). We call F the 
round function, iterated 16 times in this case. 

F is represented in more details in Figure 2. The general idea of Davies- 
Murphy attack is to look at two adjacent S-boxes (say Si and S 2 ). Because of 
the expansion phase, two bits of the input have been duplicated and are shared 
by the inputs of Si and S 2 . These two bits are the two rightmost bits of Si and 


1 Here it is t-th order DPA, since t intermediate data are considered. 
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Fig. 1. The general structure of DES 

the two leftmost bits of £2 • Consequently the output distributions for £ 1 and for 
£2 are not independent. A precise analysis shows that the joint distribution is 
not uniform. Moreover, depending on one key bit 2 , two distributions (both non 
uniform) can be observed. Theoretically this allows an attacker to learn the sum 
of the 4 key bits corresponding to the shared positions in £1 and £2 (see [in]). 



To give an illustration of the Davies-Murphy biased distributions, we focus 
on the S-boxes £1 and £2. We denote by (ki,k2, k? J: Aq) the 4 subkey bits corre- 
sponding to the “shared” positions of £1 and £ 2 , and we call k = Aq ® fc 2 ® k 3 ® fc 4 
the sum of these 4 bits. In Table |l]we represent the output distributions for both 
cases k = 0 and k = 1. y± and y 2 represent respectively the outputs of £1 and 
£2. These distributions were simply obtained by looping on all possible inputs 
of £1 and £2. 

This kind of imbalance was initially observed by Davies 0 - At first, it was 
thought that the attack could not be extended to the full DES. Indeed the pre- 
vious observation extends to 16 rounds by composing 8 times the distributions. 


2 Actually, it is one linear combination of key bits. 
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Table 1. Biased Distributions for Si and S 2 (all elements in the table should be divided 
by 2 10 ) 



The XOR of plaintext and ciphertext is therefore non uniform and it turns out 
things depend only on one combination of key bits. Unfortunately the resulting 
imbalance is too small to be detected. Later on, Biham and Biryukov demon- 
strated how to improve this attack to obtain an attack faster than exhaustive 
search for the full DES [5]. In this paper we focus on Davies-Murphy’s biased 
distributions for just one round. 


4 Extension of Davies-Murphy to the Hamming Weight 

The key observation of Davies-Murphy attack is that, for any DES inner round, 
intermediate data are not distributed uniformly, for randomly-chosen inputs. 
However in a power attack we do not have access directly to the intermediate 
data but to the power consumption (which is hopefully correlated to the data) . 
Since we assume the Hamming weight model, this correlation depends on the 
Hamming weight of the S-box output. Hence it is natural to consider how the 
Davies-Murphy property translates to the Hamming weight. 

As a first example, we consider the S-boxes Si and S 2 and look at the joint 
distribution of {hi,h 2 ) = (H(5j (ajjJ), H^fe))) where X\ and are uniformly 
chosen. The resulting distribution is given in Table[2] 

Four values are biased in Table[2] (the corresponding positions are (hi, I12) = 
(0, 2), (4, 2), (0, 3) and (4, 3)). Hence the imbalance exists but is not huge. Still, 
we hope to make it exploitable but we need to introduce appropriate statistical 
tools. 

Definition 1 . Let D\, D 2 be two distributions over some finite domain X. The 
statistical distance between V 1 and V 2 is defined as 

\Di-V 2 \ =^ 2 \ d i(x)-V 2 (x)\ 

xex 
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Table 2. Distributions of output hamming weight for Si and S 2 (all elements in the 
table should be divided by 2 10 ) 



Using this definition, we can compute the statistical distance between the 
previous distributions. Let Li be the distribution of hamming weight for uni- 
formly chosen inputs. T>i denotes the distribution in the case k = i. For S-boxes 
Si and S-2, we can easily compute : 


The imbalance for S-boxes Si and S2 is not the best we can obtain. We 
repeated the same experience with different pairs of S-box and obtained better 
results. This is summarized in Table El 

When using random inputs, all pairs of adjacent S-boxes present an imbalance 
regarding the output hamming weight. The best ones are obtained for (82,83), 
(Sf,S$) and (Sg,Si). One can also notice that 


Table 3. Statistical distance between distributions Li, Do and D\ 
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\D 0 — U\ = |2?i -U\= 0.5 X \D X - X> 0 | 
always holds due to the symmetry property : 

V a {x)+V 1 {x) = 2 • U{x) 

Therefore we have exhibited a Hamming weight version of the Davies-Murphy 
imbalance on DES, and we are confident that the electric consumption for adja- 
cent S-boxes is biased, even for randomly-chosen plaintexts. 


5 The Davies-Murphy Power Attack 

In this section, we want to turn the imbalance of Hamming weight into a pow- 
erful side channel attack against DES. First, we need to specify which specific 
assumptions we make about the power consumption of the cryptographic device. 


5.1 Assumptions 

As mentioned previously, our general assumption is the Hamming weight model. 
However, before describing an attack, we need to precise more specifically this 
model. 

A first and crucial question is to determine what the reference state R cor- 
responds to in practice. In [9], some experiments were conducted on different 
hardwares to answer this question. Depending on the chips, different results 
were obtained. In many cases, R corresponded to the address of the input value 
or to the opcode of the current instruction. For other chips, R was always 0, pre- 
sumably because these chips clear the bus between each instruction. Overall it is 
reasonable to consider that each instruction corresponds to a unique constant R. 

More formally, we make the assumption that there is a constant R x , inde- 
pendent of the round, such that the electric consumption W x of S-box 
Si is 

Wi = A H( w © Ri) + 6 

with the same notations than in Section[3] 

Moreover, we suppose that all S-box computations are done separately, 
hence we can observe any Wi separately by looking at an appropriate portion of 
the power consumption curves. This assumption is reasonable, but may be sub- 
ject to discussions, depending on the implementation. Indeed some computations 
might be done in parallel (for instance, on a 8-bit architecture, it is likely that 
pairs of adjacent S-boxes are executed simultaneously, thus we could observe 
only Wa + 

We further explore these different scenarios in Section 0 Here, we explore 
only the case where all S-boxes are computed sequentially. This is convenient to 
describe a basic attack. 
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5.2 The Principle of the Attack 

We have already seen that (H(yi),H(y i+1 )) is biased a priori for random plain- 
text, depending just on one key bit k. Actually what we observe also depends 
on the unknown constants Ri,Ri + 1 and on the noisy term 6. The general idea 
of the attack is decomposed in 3 steps: 

— First, we observe that the distribution of (H(yi ® Ri),H(yi + \ ® Ri+i)) is, in 
general, still biased for most constants Ri,Ri + \. 

— Secondly, we build an empirical distribution of (H(yi ® Ri), H(y,i + i ® Rj+i)) 
by encrypting a set of randomly chosen plaintexts. Hence we need to iden- 
tify the portion of curves corresponding to Wj and W i+ \, then to counter 
the influence of the noisy term. The resulting empirical distribution is then 
matched with theoretical results. 

— Finally, a good method to perform this matching is proposed. Our strategy 
is to compare distributions for two different inner rounds (not necessarily 
consecutive). 

1 - Adding the Constants in the Distributions. To analyze the influence 
of constants Ri, we simply explored all possible cases. Hence we have looked at 
distributions ® R-i), H(y i+ i ® Ri+i)) for various pairs of S-boxes, with all 

possible constants (Ri, Ri+i). These results are summarized in Table [j] As be- 
fore, distribution T>i corresponds to the case k = i. Besides the column “constant 
= 0” corresponds to the previous results (see Table[3]. 

Table 4. Statistical distances with constant Ri's 


S-boxes 


Statistical Disti 

mce \D\ — T>q\ 


constant = 0 

worst constant 

best constant 

average value 

(SiA) 

A 

0 

A 

M 

( S 2 ,S 3 ) 

A 

A 

A 

3 -W 

(S 3 ,S 4 ) 

158 

0 

As 

AsP 

(S^Ss) 

A 

0 

A 

2 #* 

(S 6 ,S 6 ) 

A 

A 

A 

HP 

(S 6 ,S 7 ) 

A 

A 

158 

HP 

(SV,S 8 ) 

TB 

re 

Air 

HP 

(Ss.SO 

A 

155 

A 

HP 


Clearly, we observe that the average distance is quite significant for all pairs 
(it ranges from °'gj 2 3 ~ ^ to 3 '®| 6 — |). We also observe that there are “good” 
and “bad” constants, but in average an imbalance is expected. 

2 - Getting Rid of the Noise. In the second phase, our goal is to build 

empirical distributions. More precisely, we encrypt a set of M randomly chosen 
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plaintexts and we monitor the electric consumption. We target the appropriate 
portion of the curves to observe (Wi, Wi+ 1 ). Our goal is, from these observations, 
to decide the underlying value of (H(yi ® Ri), H(y i+ i ® /? i+1 )) for each sample, 
despite the noise. Hence we obtain an empirical distribution over M samples. It 
is well known that when M grows, the empirical distribution converges to the 
theoretical distribution. More precisely, to get rid of the noise, two situations 
must be distinguished : 

1. Suppose we can repeat each experiments. Typically, we can obtain twice 
from the cryptographic device the same encryption and the same execution. 
This assumption is commonly used in power analysis attacks. In this case the 
noise is eliminated by multiplying the samples for each trace and computing 
the average consumption. 

2. Suppose we cannot repeat any experiments. Typically, any encryption corre- 
sponds to a random plaintext. This can result from masking countermeasures 
(with a fresh mask for each block !) or from a randomized mode of operation 
(CBC plus IV for instance). 

In the first hypothesis, there is just an extra workload per message to make 
the noise arbitrarily small. Typically, if we have a Gaussian noise with expected 
value 0 and standard deviation a, we expect to reduce the standard deviation by 
a factor \/M if we repeat M times each experiment. Therefore, since our model is: 

Wi = A H(w <BRi)+0 

we consider the noise is sufficiently small when A -^==, i.e. the noise is negli- 
gible compared to the data-dependent term. 

In the second hypothesis, we cannot eliminate the noise by averaging methods. 
However we hope that it will only slightly perturb our empirical distributions. 
Hence we suppose A a, so when making a decision for each hamming weight, 
we have a small probability p of making a mistake. Our practical experiments on 
a smart card confirmed this supposition (see SectionUJ. A justification is that the 
data-dependent terms represent the consumption of bus lines which is generally 
dominant in a chip. More precisely, our decisions are made using thresholds: 

1 Wi 1 

t~ 2< -y < t + 2=^ H( ^ ® R i) = t 

For example if ^ is in the range [2.5 - 3.5], we decide Wyi ® Ri) = 3. 
If the noise is indeed negligible, we are successful in predicting the hamming 
weight with overwhelming probability. This threshold strategy is summarized in 
Figure 3 and further analyzed in Appendix A. Of course, in practice, A is not 
known but we can set up thresholds experimentally to fit to the observations. We 
stress out that this analysis requires a good knowledge of the electric behavior 
of the chip. 

3 - Comparing Two Inner Rounds. After the step 2, we construct an empir- 
ical distribution of hamming weight from power consumption curves. We know 
this is biased depending on one round key bit k. However since the key is fixed, 
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0 


decide h=0 


observation 


Fig. 3. Threshold rules of decision when observing 


we have nothing to compare it with. Besides it is impossible to tell the value of k 
just by looking at the distribution, because it highly depends on the unknown R 4 . 

However an attack is still possible by looking at two different inner 
rounds of DES (not necessarily consecutive rounds). For instance, suppose 
we encrypt random plaintexts and compare the consumptions of round 1 and 
2 for the adjacent S-boxes (82,83). At round 1 we observe (W2, W3), which is 
distributed differently depending on whether some first round key bit k is 0 or 
1. These distributions are respectively called Tfi and Dq. A similar observation 
holds for round 2 with a second round key bit k' . Thus 

— If k = k' = i, we have distributions V, for both rounds. 

— If k / id, we have distributions V 0 for one round and V\ for the other. 


T> 1 and D 0 depend 


the constants J?j, but we have seen that, in average 


and even in the worst case, this value is So, in theory, if the number of 
samples M is sufficient (typically M > 0 1 1 142 ~ 100) , we should be able to tell if 
k = k' or k / id and thus learn one bit of information about the key. In practice, 
we retrieve two empirical distributions £° and E 1 . We must decide whether these 
distributions are the same ( k = k') or if they are different ( k / id). Because of 
the symmetry property exhibited in Section |4j we use the following indicator : 


I=£(£°(*)-W(s))x (£*(*) -«(:*)) 


Basically, we have normalized the empirical distributions by subtracting the 
U distribution, and then we compute a scalar product. If k = k' = 1 , then this 
indicator is positive : 

h=k' = y^(Pj(x) - U(x )) 2 


Otherwise, if k / id, then the indicator should be negative 
4/*' = 52(Vo(*) ~U(x)) x (2M*) -W(s)) 


= -Y^(V 0 (x)-U(x)f 


= -^( P 1 ( a; )-^)) 2 
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because of the symmetry property described in Section [I] Therefore 
Ik=k' = —Ik 

and these values are sufficiently large to be detected in practice. 


5.3 Simulations 

We ran some simulations of the previous distinguisher to evaluate our ability 
to predict correctly whether k = k', and we obtained the results summarized 
in Table S Four intensity of noise where considered (see Appendix A for the 
role of the probability p) as well as several values for the number of samples M. 
We repeated the attack about 1000 times in each case, with a random choice of 
constants Ri . 


Table 5. Simulation results 


M = 

(51.5 2 ) 

(5 2 .5 3 ) 

(5 3 .5 4 ) 
(S 4 ,S 6 ) 
(S s ,S e ) 
(Se.Sr) 
(S 7 ,S 8 ) 
(S s ,S 1 ) 


4000 40000 


4000 100000 


It appears from Table El that the best pairs of S-boxes are ( 82 , 83 ) and 
(St, S 3 ), as predicted in Section 1 5.21 Hence, for our basic attack we will use 
any of these two pairs. For the variation attack with an 8-bit architecture, we 
can only use pairs with index of the form (2 i, 21 — 1). Fortunately we can use the 
pair (7, 8) here, which is strongly biased. 


6 Some Variations of the Attack 

In the previous section, we considered a simple hypothesis where all S-boxes 
were computed separately. Therefore we could identify portions of the power 
consumption curves corresponding to each S-box. In practice, the implementa- 
tions are often more complex and we need to investigate if our attack applies to 
other situations 
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6.1 A Real-Life Situation : 8-Bit Architecture 

As an example of our attack, we have considered a recent smart-card running 
a software DES implementation. The card also featured some usual hardware 
countermeasure (but no software countermeasure like masking). These counter- 
measures included a variable internal clock and some random peaks of power. 
Despite these protections, we managed to identify the power consumption cor- 
responding to each portion of the DES execution. This analysis required first 
to understand well the behavior of the card. The trickiest part was to eliminate 
the random peaks of power but it turned out they were not “that” random and 
their presence was strongly correlated with the external clock. 

In addition, we realized that two S-boxes are executed simultaneously by the 
card, i.e. each pair of adjacent S-boxes (Si and S2, S3 and S4, etc ...). Therefore, 
the power consumption observed is W-ji + W^-i for i = 1 ... 4. It is strongly 
correlated with the sum of the hamming weights: 

H(ltei ® R 21 ) + H(y2i-1 ® Rzi-l) 

= H(( to $ i^i) 1 1 ((y 2 j-t ® Rii-i))) 

Accordingly, we expect to observe 9 groups of curves locally, if we have many 
samples (corresponding to hamming weight ranging from 0 to 8). In fact, due 
to the noise influence, it is difficult to make the groups appear very distinctly, 
but if we display a few curves (see Figure 4), a clear distinction starts to ap- 
pear depending on the hamming weight. Low hamming weight correspond to low 
consumption (few bits are flipped from the reference states), while high ham- 
ming weights curves are located at the top of this Figure. In addition, these 
experiments illustrate the fact that some noise 6 is indeed present, but it is rel- 
atively small compared to the data-dependent term, since the Hamming weight 
distinction appears clearly. 

In this scenario, we can only observe the sum of power consumption for cer- 
tain pairs of S-boxes. We computed theoretically the expected imbalance for 
these pairs (see Table EI>- Here the distributions considered are over the sum 
of hamming weights hi + hi and not the joint distribution as previ- 

ously. 

Hence, the statistical distances are still relatively high for the four pairs of 
S-boxes. To perform the Davies-Murphy power attack here, w e can use again the 
trick of comparing two different inner rounds, like in Section EH 


6.2 Case When More S-Boxes are Computed Simultaneously 

When considering software implementations of DES, we believe the most com- 
mon situation are those where 1 or 2 S-boxes at most are computed simulta- 
neously. This was developed in Section [5] and Section HTT1 To our knowledge, 
no software implementation presents a higher degree of parallelization than 
that. 

However, when turning to DES hardware implementations, more than two 
S-boxes are often computed at the same time. Things are thus more complex 
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Fig. 4. Distinction of Curves According to the Hamming Weight 


Table 6. Statistical distances in the 8-bit scenario 


S-boxes 

Statistical Distance \T>i — D o| 


constant = 0 

worst constant 

best constant 

average value 

(A\,5 2 ) 

u 

0 

g 

igft 

{Sa, St) 

ik 

0 

k 


{S 5 ,s 6 ) 

k 

k 

§6 

1.076 

32 

C St,Ss ) 

m 

m 


Iff* 


because we observe many biased distributions simultaneously, and this depends 
on many key bits. We are currently investigating some refined version of our 
attack in this case. We believe an attack can be achieved since the imbalance is 
detectable in theory, but it will probably not be very efficient. 


7 Impact on DES Implementations 

Modern countermeasures against Side Channel Attacks are often focused against 
DPA. Accordingly they try to make intermediate data handled during the block 
cipher computation as random and unpredictable as possible. Two main tech- 
niques have receive a huge interest in recent years 

— Masking Techniques DEU where the idea is to ensure that critical intermedi- 
ate data are equal to the “true” data XOR some random mask. Masking the 
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round input has clearly no effect, since we process randomly-chosen data. 
However masking the output is problematic since the Davies imbalance now 
depends on the mask. But, for consistency, masking countermeasures gen- 
erally require some unmasked round output (see E). This was not believed 
to be critical because the goal was to thwart DPA and HO-DPA. However 
DMPA will still work here, except we need to choose two inner rounds with 
unmasked output. 

If all round outputs were masked with the same value, an higher-order 
version of DMPA could be envisaged 3 . So the best protection consists in 
masking all round outputs with a distinct value. But this is probably too 
expensive in practice (actual countermeasures use one or two masking values 
at most). 

— Duplication Techniques COD where all intermediate data are split into two 
parts, using the secret sharing principle. However, by analyzing simulta- 
neously the behavior of both parts, the Davies imbalance should still be 
observed. Since everything is duplicated, the analysis is probably more com- 
plicated because 4 S-boxes need to be considered instead of just 2. 

Therefore the Davies-Murphy Power Attack (DMPA) is likely to defeat most 
“software” countermeasures. In fact, this new attack is not fundamentally dif- 
ferent from classical DPA : both gather power traces and sort them according to 
some intermediate data, the goal being to verify a guess on a few key bits. How- 
ever, while DPA focuses on predicting some data from the plaintext and a few 
key bits, DMPA does not require the knowledge of the plaintext. The analysis 
is based only on the internal structure of DES and we can predict intermediate 
data (actually a bias on intermediate data), only from a few key bits. The ad- 
vantage is that we can focus our analysis on any inner round, while DPA usually 
focuses on the first (or last) rounds of DES. 

An other advantage is that countermeasures designed specifically to thw art 
the family of DPA attack (like masking, duplication, or others ...) are unlikely to 
be very efficient as a protection against DMPA. The main drawback of the attack 
is that it is rather expensive in terms of messages encrypted. Moreover it requires 
a fine analysis of the electric behavior of the target cryptographic hardware, in 
order to find an appropriate power consumption model and to identify each 
portion of the DES execution. So there is a lot of preliminary analysis to do 
before applying the attack. 

Finally DMPA proves that even slight weakness or small “non-random” be- 
havior of a cipher can be exploited to mount a side channel attack. Software 
countermeasures are helpful to complicate the task of the attacker, but a better 
protection against power attacks will be obtained if 

— the cipher behaves as randomly as possible. 

— efficient hardware countermeasures are implemented, to limit the information 
leaked in the electric consumption. 


3 Actually the trick from Section fA2l of using power traces of any two inner rounds is 
already, by definition, a second-order attack. 
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8 Extensions 

All our analysis has focused on the case of DES. Indeed the principle of Davies- 
Murphy attack was initially developed specifically against DES. However, more 
generally, for any Feistel cipher with a non-bijective round function, some im- 
balance in the round output necessarily exists. In this case, the requirements for 
DMPA are 

— Express the output imbalance with a small number of key bits. 

- Find a correlation between the non-randomly distributed data and the elec- 
tric consumption 

The first requirement depends on the cipher, while the second depends on 
the cryptographic hardware considered. We did not explore further to find ap- 
plications on other algorithms but we believe it is an interesting topic for further 
research. 


9 Conclusion 

We have proposed a new side channel attack against DES, the Davies-Murphy 
Power Attack. It is based on the well known Davies-Murphy attack. Like its 
predecessor, our attack uses non-uniform output distributions of adjacent S- 
boxes. Then we detect this imbalance using electric consumption curves. 

DMPA is very powerful, because it requires no information about the plain- 
text and can be performed on any inner rounds of DES. Therefore we believe 
it can defeat software countermeasures, which do not take into account this 
type of threat. However DMPA is rather expensive : good knowledge of the de- 
vice behavior regarding power consumption is required, and the data processing 
complexity is rather high. For a non-protected implementation of DES, simpler 
side-channel attacks (like DPA) should be preferred. 
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A Statistical Influence of the Noise 

In Section [H we are interested in distinguishing two distributions, V 0 and T> 1 . 
Our analysis of DES revealed that the statistical distance d = \T>o — T>i\ was 
sufficiently large to distinguish between these two distributions. But in practice 
we need to build an empirical observation of these distributions in the presence of 
noise. As we argued, this noise is generally small, but still it may result in errors 
of prediction in the threshold technique of Figure 3. There is a small probability 
p that the noise is larger than 0.5 A and thus we predict h + 1 or h — 1 instead of 
the “true” ft. We call D[ the new distribution obtained when the noise is taken 
into account. We have : 

£>'(ft) = p Vi(h - 1) + p Vi(h + !) + (!- 2 p) Vi(h) 


Thus 


A(h) = Z>'(ft) - Vi{h) = p ■ [Di{h - 1) + T>i{h + 1) - 2 Vi{h)) 

A(h) is the difference of probability of deciding h, resulting from the noise in- 
fluence. We see that if p -C 1 , then A (ft) <C 1 for all ft e { 0 , ... , 4}. Therefore 

\V< i -V i \ = ^\A(h)\ = e«.l 


for i = 0, 1. Hence, it is still possible to make the difference between the two 
distributions since 

l®'i - &o\ < Pi -VvM'Dx- 2>o| + \% - 25o| 

< \T> 1 -V 0 \+2e 

Therefore as long as the noise results in small probabilities of incorrect deci- 
sions, we can still apply the same methods. 
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Abstract, '/’-functions are a new class of primitives which have recently 
been introduced by Klimov and Shamir. The several concrete proposals 
by the authors have multiplication and squaring as core nonlinear op- 
erations. Firstly, we present time-memory trade-off algorithms to solve 
the problems related to multiplication and squaring. Secondly, we apply 
these algorithms to two of the proposals of multi-word T-functions. For 
the proposal based on multiplication we can recover the 128 unknown bits 
of the state vector in 2 40 time whereas for the proposal based on squaring 
the 128 unknown bits can be recovered in 2 21 time. The required amount 
of key stream is a few (less than five) 128-bit blocks. Experimental data 
from implementation suggests that our attacks work well in practice and 
hence such proposals are not secure enough for stand-alone usage. Fi- 
nally, we suggest the use of conjugate permutations to possibly improve 
the security of T-functions while retaining some attractive theoretical 
properties. 


Keywords: stream cipher, T-functions, multiplication, cryptanalysis, 
time-memory trade-off. 


1 Introduction 

Stream ciphers are a fundamental primitive in cryptography. Encryption is per- 
formed by XORing the message bit sequence with a pseudo-random bit sequence 
while decryption is performed by XORing the cipher bit sequence once more with 
the same pseudo-random bit sequence. 

The cryptographic strength of a stream cipher depends on the unpredictabil- 
ity of the pseudo-random bit sequence. The other important issue is efficiency of 
the pseudo-random generator. Most practical proposals for stream ciphers strive 
to achieve a good balance between speed and security. Typically stream ciphers 
are built out of linear feedback shift registers, nonlinear Boolean functions and 
S-boxes. See [4] for various models of stream ciphers. 
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Recently Klimov and Shamir [1-3] have proposed a new class of primitives for de- 
sign of stream ciphers. They call their primitive T-functions and have developed a 
nice theory for analysing T-functions. From an efficiency point of view, T-functions 
are extremely attractive, since they can be built using fast and easily available opera- 
tions on most processors. From a security point of view, there are many nice features 
including the single cycle property of the underlying permutation. 

Klimov and Shamir [3] have also introduced multi-word T-functions and have 
extended their theory to cover such functions. In [3] , they present several concrete 
constructions of multi-word T-functions. A key constituent of their proposals is 
multiplication modulo 2 64 . 

Our Contributions: In the first part of the paper, we study the following 
problem related to multiplication. Suppose x, y and z are n-bit integers satisfying 
xy mod 2" = z. Further, suppose the m most significant bits of x, y and z are 
known. The problem is to compute all possible combinations of the (n — m) least 
significant bits of x and y such that the multiplication holds. 

We present a time-memory trade-off algorithm to solve this problem and make 
a detailed study of the effectiveness of the algorithm under different scenarios. 
We also study the related problem of squaring, i.e., when x = y. It turns out 
that the algorithm for multiplication is not efficient for squaring and hence we 
develop a separate algorithm to solve this problem. Apart from the application 
to T-functions, our algorithm can possibly be used for analysing other ciphers 
based on multiplication. 

The second part of the paper consists of analysing the security of two concrete 
proposals of multi-word T-functions from [3]. The first proposal involves multi- 
plication and the T-function operates on a state vector consisting of four 64-bit 
words. The pseudo-random bit sequence obtained from the state vector consists 
of the 32 most significant bits of each of the four 64-bit words. Thus the state 
vector has 128 unknown bits. We perform a detailed analysis of this T-function. 
The major step in the analysis consists of an application of (a modification) of 
the algorithm to solve multiplication as mentioned above. The final result that 
we obtain is that the 128 unknown bits can be computed in 2 40 time which 
makes this proposal unsafe for stand-alone use as a pseudo-random generator. 

The second proposal that we consider also operates on a state vector of 
four 64-bit words and produces 128 bits as before. The difference is that this 
proposal involves squaring instead of multiplication. Consequently, our analysis 
of this proposal involves the algorithm to solve squaring. In this case, we obtain 
an algorithm that determines the 128 unknown bits in 2 21 time. Hence this 
proposal is much more insecure than the one based on multiplication. 

The required amount of known pseudo-random key stream for both the above 
attacks is only a few (less than five) 128-bit consecutive key stream blocks. In 
most cases, we expect the attack to work with only three 128-bit consecutive key 
stream blocks. This shows that these two proposals, and probably other similar 
proposals, are not secure enough for stand-alone usage. 

One possibility for improving the security is to extract less number of bits 
from each state vector. We consider this possibility for the multiplication based 
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T-function mentioned above, where only 16 most significant bits of each 64- 
bit word of the state vector is produced as output. Thus a total of 64 bits are 
produced from each state vector and 192 bits are unknown. Our attack also 
applies to this situation and the 192 unknown bits can be obtained in 2 112 time. 
Though infeasible in practice, this constitutes a theoretical attack on the system. 

We have implemented the algorithm to solve multiplication and our esti- 
mate of the expected run-time is supported by experimental data. We have also 
implemented the attack on a scaled down version of the multiplication based 
T-function. Instead of a state vector consisting of four 64-bit words we have 
worked with four 32-bit words. In this case, we can actually recover the 64 un- 
known bits of the state vector. This shows that our attack works quite well in 
practice. We have also implemented the algorithm to solve the squaring prob- 
lem and the corresponding attack on the 64-bit version of the squaring based 
T-function proposal. Experiments show that the attack performs as predicted 
by the theoretical analysis. 

Finally, we suggest a method based on conjugate permutations to possibly 
improve the security of T-functions while maintaining some desirable features 
such as the single cycle property. 


2 Multiplication 


We consider the following problem. Suppose two n-bit integers x and y are 
multiplied modulo 2" to obtain an n-bit integer z. The m most significant bits 
(MSBs) of x, y and z are known and we have to find all possible solutions for 
the (n — m) least significant bits (LSBs) of x and y such that xy mod 2 n = z. 
This problem can be stated more precisely as follows: 


Problem: Mult 

Input: Three integers a;*- 1 ), y W and such that, 0 < i&WjyWjzW < 2 m . 
Task: Find all pairs of integers (x 1 ' 0 ' 1 such that, 0 < x^Ky^ < 2 n ~ m , 
x = 2 n ~ m x M + *( 0 ), y = 2 + yv°) and 


= [.a.j m od2- = l («. 


(i) 


Note that the operation x mod 2* returns the t LSBs of x and the operation 
returns x t, i.e. the binary representation of x right shifted t times. The 
number of unknown bits in the pair (x^K j/W) is 2 (n — m) and the m known 
bits on the right hand side of JD imposes m restrictions on these unknowns. 
Hence, on an average, one should expect = 2 2 ”~ 3m distinct pairs of 

(x(°\yW) to be solutions to Mult. See Section [5] for an emperical justification 
of this statement. 

We first consider the naive approaches to solve Mult. There are (2 n — 2m) 
unknown bits and one approach is to try all possible combinations of these un- 
known bits. This approach requires 2 2n-2m time. The second naive approach 
using an offline table computation can be described as follows. For each pos- 
sible pair of n-bit integers (x,y) compute the product z = xy mod 2". Store 
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in Tab^ 1 ),^ 1 )^ 1 )] the set of all pairs which are solutions to Mult 

for the instance z^\ This table takes 2 2 " time to prepare and store. 

The preparation of the table can be done offline. Given a particular instance 
x(b. j/ 1 ' 1 ■ of Mult the solutions can be directly obtained from the entries of 
the row Tab^ 1 ),^ 1 ), z^}. Since, on an average, there are 2 2n ~ 3m solutions, at 
least this amount of online time will be required in producing the solutions. 

Thus the online time will be at least 2 2h-3to (requiring 2 2n precomputation 
time and a table of size 2 2n ) and at most 2 2n ~ 2m (using exhaustive online search 
but without using any look-up table). We describe solutions to Mult whose online 
time complexity is between the two extreme values and which uses a table of 
moderate size. Thus our algorithms can be considered to be time-memory trade- 
off algorithms. 

To improve readability, we will use the same notation for an integer and its 
binary representation. Also the length of a binary string will be denoted by | . | . 
Thus a binary string x of length \x\ = k denotes an integer x e {0, . . . , 2 k — 1}. 
For two binary strings x\ and X 2 , by (x 2 ,xi) we denote the binary string x 
obtained by concatenating X 2 and x\. Using the integer representation of x\ . X 2 
and x we have x = 2 ^X 2 + x\. 

Using this notation, we write x = x ^2 n ~ m + x^°\ y = t/ 1 ) 2 n ~ m + j/(°) and 
z = ^f 1 ) 2 n ~ m + z(°\ where |x| = \y\ = \z\ = n, = l-z^l = m and 

l* (0) l = |y (0) l = k (0) l = n — m. We now introduce parameters no,ni and n 2 
defined by the following equations. 

x = X^2 ni+n » + W«2"° + X(°) 1 

y = y(i)2 ni +y(°> l (2) 

2 = z( 1 '>2 ni+n ° + ZW J 


where |X( 2 )| = n 2 , |X«| = m, |X<°>| = no , |y(i)| = n - m, |y< 0 >| = m, 
\ZW\ = n 2 and \Z^°'>\ = rii + n$. We require these parameters to satisfy certain 
conditions. These conditions are given below. 


1. no + rii + n 2 

2. no < n — m 

3. n 2 < to 

4. rii < n — m 

5. ni < n 2 


6. n 2 + ni > m 


: This is required since x, y and 2 are n-bit integers. 

: This ensures that X^°) is a suffix of x^°\ 

: This ensures that X (2 ' > is a prefix of 
: This ensures that is a suffix of i/ 0 ). 

: This ensures that the expected number of entries in 
each row of Tab[] (see later) is one. The case ni > n 2 
is also feasible but does not provide better results. 

: The case n 2 + ni < m is also feasible, but does not 
provide better results and hence we do not consider it. 


We now define binary strings G 1 " 1 ) , U 1 - 2 ' 1 and U-b in the following manner. The 
strings U W and are such that = (U^, X^) and X^ 1 ) = [U^ 2 \U^), 
where |f/b)| = n — m — no, \UM\ = m-n 2 . Then x (1) = (X( 2 ), U™). The 
string Ub) i s suc h that y( °) = (yid^yffO^ where |y(b| = n — m— n\. Then 
yf 1 ) = (yf 1 ), y(U). Note that the portion f/G) of X^ 1 ) is provided as part of the 
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input whereas the part U W of has to be determined. Also the string 
is part of y ^ and has to be determined. These substrings are shown in Figure [H 


M ) | 

*(° ) 


: r 1 : 

zw 

z m 


yW 

yW) 




T 



y(0) 


uw 

' W- * 

Fig. 1. Definitions of substrings 


Our algorithm is based on the following result. 

Proposition 1. j = r + d + c, where r = j j , d = y(°) J fO) -\ 

I y( o) x ( 1 )2 no I 


and c G {0, 1, 2}. 


Proof: We write 


I xY^‘2 n * 


x (0)y(i) 2 m 


Note that r = I ' I = I X (2) y (1) 2 ni + X (1) F (1) -f 2no+ni 


y(o)j( 1 )2"o y(o)x(°) I 


+B1 2 n ~ n ‘ 

I X (0)y(l) 2 u 1 I 

! N^H h 


2 n-n 2 j 

I y(°)j( 1 )2"« I 


^ y(Q)x(°) j 


for some c G {0, 1, 2}. Further, since y(°) < 2 ni , X (°) < 2"°, we have JSf (°)y (°) < 
2 «o+ni = 2 n-B2 anf ] hence [y(°W(°) /2 n ~ n2 \ = 0. Putting all these together 
gives us the required result. □ 
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Based on Proposition Q] we have the following algorithm to solve Mult. The 
algorithm uses a table Tab[] which is prepared in the first phase and is used to 
solve Mult in the second phase. 

Algorithm 1 

Input: and z^\ 

1. Write = (X^ 2 \ U^), where |X( 2 )| = n 2 and \U^\ = m — n^\ 

2. set Z W to the ri2 most significant bits of z W; 

3. for U& G {0, 

4. set 

5. for y(°) 6 {0, l}" 1 

6. compute + |_(F(°)W«2"°)/2"-” 2 J mod 2” 2 ; 

7. Tab[dW] = Tab[d«] U {F^}: 

8. end for; 

9. for V<$) G {0, 1}"° X {0, 1}"-™-"! 

10. set F» = (y«,F«); set x = (X™, X^\ iM); 

11. compute = \{xY^2 ni )/2 n ~ n2 \ mod2" 2 ; 

12. force {0,1, 2} 

13. compute = Z W — — c (mod 2" 2 ); 

14. for each F<°> € Tab[rf( 2 )] 

15. set y = (F« ? ,r (0) ); 

16. if (\{xy)/2 n ~ m \ mod 2 m = z W) then 

17. set ®(°) = {U^\X^) and j/W = (V^,Y m % 

18. output 

19. end if; 

20. end for; 

21. end for; 

22. end for; 

23. end for; 

2.1 Complexity of Algorithm 1 

The space complexity of Algorithm 1 is the space required to store Tab[]. By 
construction Tab[] has 2l (i<li = 2" 2 rows and a total of 2^ Y<0> = 2 ni entries in 
all the rows. By Condition 5 after Equation (j2j) we have ni < rta and hence on 
an average the number of entries in each row of Tab[] is at most one. 

The time required by Algorithm 1 depends on the number of entries in a row 
of Tab[ ]. The expected number of such entries is one and this allows us to obtain 
the expected run-time R of Algorithm 1: 



(3) 
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We now consider two cases and obtain the value of R in each case. 

Case 1: ri 2 = m. Hence riQ + n\ = n — m. In this case R = 2 2 ” 1 + 3 x 2 2 ( n_m ) _ni . 

Subcase la: n = 64 and m = 32. Then R = 2 2 ” 1 + 3 x 2 64- " 1 . This expression 
is minimized when ni = 22, whence R = 2 44 + 3 x 2 42 = 7 x 2 42 . 

Subcase lb: n = 64 and m = 16. Then R= 2 2 " 1 + 3 x 2 96_rtl . Since m < ri2 = 
m= 16, the maximum value of m is 16. Choosing ri\ = 16 gives R= 2 32 + 3x2 80 . 

Case 2: ri 2 < m. This case is more complicated to analyse and we first perform 
a special case analysis by setting ri2 =n\. Then no = n — 2m and R = 2 3 " 1_m 

3 x 2 2 

Subcase 2a: n = 64 and m = 32. Choosing m = 24 we have i? = 2 40 +3x2 40 = 2 42 . 

In general n 2 / =m . However, we have verified that for n = 64 and m = 32 
and for all possible distinct values of no,m and n 2, the value of R is minimized 
for ri 2 = ni = 24 and no = 16. Thus the special case is also optimal for the 
general case. In fact, for n = 64 and m = 32, R = 2 42 is the minimum possible 
expected run-time for Algorithm 1. 

2.2 Offline Table Preparation 

The expected run-time of Algorithm 1 can be made optimal by using a larger table 
which can be prepared offline. We describe this idea for n = 64 and nn = 32. 
Write x = 2 32 a/ 1 ) + a/°) and y = 2 32 yW + j/(°). We write |_(a:y)/2 32 J = d + r, 
where d = |_(an/°))/2 32 J and r = an/ 1 ). 

In the offline table preparation phase, for each (a/ 1 / a/ 0 /?/ 0 )) € {0, l} 32 x 
{0, l} 32 x {0, l} 32 , we compute d = |_(an/°))/2 32 J mod 2 32 and set 
Tab[x«,a/°),d] = Tabla/ 1 *,®* 0 *,^ U {j/°>}. 

In the online phase, we are given a/ 1 /?/ 1 ) and z <l> . For each possible value 
of a/°) e {0, l} 32 , we compute r = an/ 1 ) mod 2 32 ; d = r — z W mod 2 32 and for 
each y(°) € Tabla;^ 1 ),^^ 0 ),^] output 

The run-time for table preparation is 2 96 ; the space required to store Tab[] 
is also 2 96 and the (expected) runtime of the online phase is 2 32 . Since there are 
2 32 solutions, the online run-time is the minimum possible. This comes at an 
expense of huge offline processing time and space. 


3 Squaring 

In the case x = y, the problem Mult reduces to squaring which can be formally 
stated as follows. 

Problem: Sqr 

Input: Two integers a/ 1 ) and such that, 0 < a/ 1 /,/ 1 ) < 2 m . 

Task: Find all integers a/°) such that, 0 < a/°) < 2 n ~ m , x = 2” -m a/ 1 ) +a/°) and 



mod 2 T 
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Note that there are (n — m) unknown bits and m constraints. Hence the 
expected number of solutions is max(l, 2 n_2m ). If n = 2m, then the expected 
number of solutions is one. Algorithm 1 is not very efficient for Sqr so that we 
have to deal with the problem separately. 

Let no, ni be such that no + ni = n — m and x = 2 n ~ m X^ 2 ' ) + 2 n °X^ + X^°\ 
where |X^j = m, IWW) = m and |X^| = no with no < m. 


Proposition 2. 

(xwy 


= =r + d 


+ 2X&XW, d = 


f- c, where r = 2 ni ^jb 2 ^ -f 
3 G {0, 1,2,3}. 


Based on Proposition [2J we have the following algorithm to solve Sqr. 

Algorithm 2 
Input: 


1. set k = n — (ni + 2no) = m — no; 

2. for G {0, l} n ° 

3. compute d = \{2X^ I®) /2”° J mod 2 fc ; 

4. Tab[d] =Tab[d]U{X(°)}; 

5. end for; 

6. for XW G {0, l}" 1 

7. compute r = 2" 1 (X^) 2 + [(X^) 2 /2 n '\ + 2X< 2 ) mod 2 k - 

8. for each c G {0, . . . , 3} 

9. compute d = _z^ /2"°J — r — c mod 2 fe ; 

10. for each G Tab[d] 

11. if (\_x 2 /2 n ~ m \ mod 2 m = then output (I* 1 ),!®); 

12. end for; 

13. end for; 

14. end for; 

The space complexity of Algorithm 2 is 2 m_ ”° and the (expected) time com- 
plexity is R = 2"° + 4 x 2" 1 . 


Case 1: n = 64, m = 32. In this case we choose no = ni = 16. Then the space 
complexity is 2 16 and the time complexity is R = 2 16 + 4 x 2 16 = 5 x 2 16 . This 
particular choice of no and n\ minimizes the value of R. 

Case 2: n = 64, m = 16. Choosing no = 8 and n i = 40 gives a rim-time 
R = 2 8 + 4 x 2 40 . 


4 Attacks on T-Functions 

We consider two specific proposals of multiword T-functions from [3] and de- 
scribe attacks on them. These T-functions operate on an internal state vector 
which consists of four 64-bit words. Applying a T-function once to the state 
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vector changes the value of each of the four 64-bit words. As suggested in [3], 
the extracted output consists of the most significant 32 bits of each of the four 
64-bit words of the state vector. Thus applying the T-function repeatedly to the 
state vector produces a sequence of 128-bit (four 32-bit words) output blocks. 
These output blocks are treated as the generated pseudo-random sequence. The 
secret key consists of the initial 256-bit (four 64-bit words) value of the state 
vector. 

For the attack we will assume that several consecutive output blocks are 
known. We actually require only two consecutive output blocks to perform the 
attack and a few more to verify the correctness. The goal of our attack is to 
obtain the complete 256-bit (four 64-bit words) value of the internal state vector 
at some point of time. 

For a 64-bit word w, let msb(w) (resp. Isb(io)) denote the 32 most (resp. least) 
significant bits of w. Let (xq, X1.X2.X3) be the internal state vector at some 
point of time. Let (yo, yi, y2, Vz) be the state vector after application of T to 
( Xo,Xi,X2,x 3 ), i.e., (yo, Vi, 2 / 2 , 2/3) = T(x o,Xi,X2,x 3 ). The outputs correspond- 
ing to (xo,xi,x 2 ,x 3 ) and (yo, yi, yi, 2/3) are (msb(x 0 ), msb(xi), msb(x 2 ), msb(x 3 )) 
and (msb(y 0 ), msb(yi), msb(y2), msb(y 3 )) respectively. We assume that these out- 
puts are known and our attack is to compute (Isb(xo), Isb(xi), Isb(x2), lsb(x 3 )). 

There are a total of 128 unknown bits in (xo, xi, X 2 , x 3 ) and a method to 
obtain them in time less than 2 128 constitutes an attack on the system. Our 
algorithms are much more efficient - the attacks in Section 14.11 and Section 14.21 
require time 2 40 and 2 21 respectively to compute the 128 unknown bits. 

4.1 Attack on Multiplication Based T — Function 

Consider the following T-function: 

( x 0 \ (x 0 ®s © (2(x x VCi)x 2 )\ /y 0 \ 

■«1 L Zi © (s Aa 0 ) © (2x 2 (x 3 VC 3 )) _ | yi (5) 

X 2 \x 2 © (s A ai) © (2(x 3 V C 3 )x 0 ) y 2 

x 3 J \x 3 © (sAa 2 ) © ( 2 x 0 (xi VCi))/ \y 3 J 

where ao = xo, a* = aj_ 1 A x*, 1 < i < 4, s = a 3 ® (a 3 + Co). Also, Co is odd and 
known, C\ = (12481248) i 6 and C 3 = (48124812) 16 (Equation (13) in Klimov 

and Shamir [3]). Each of C\ and C 3 are considered to be 64-bit words where the 

leading 32 bits are all zeros. 

During use of this T-function as pseudo-random generator, the quantities 
msb(xj), msb(yj) are known for i = 0, 1,2,3. Our attempt will be to obtain 
Isb(xj) for i = 0,1, 2,3. This proceeds in several steps. 

Step 1: 

First note that msb(wi®«! 2 ) = msb(u;i)®msb(u; 2 ) and msb(wiAw 2 ) = msb(w;i)A 
msb(tU 2 )- Hence we have msb(ao) = msb(xo), msb(ai) = msb(xo) A msb(xi), 
msb(a 2 ) = msb(xo) A msb(xi) A msb(x 2 ) and msb(a 3 ) = msb(xo) A msb(xi) A 
msb(x 2 ) A msb(o 3 ). The quantity s involves an addition mod 2 64 and cannot be 
directly tackled in this manner. However, we can determine the upper part of 
s with only one bit of uncertainty in the following manner. First note that we 
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have, msb(o 3 + Co mod 2 64 ) = msb(u 3 ) + msb(Co) + e mod 2 32 where e is the 
carry of lsb(a 3 ) + Isb(Co) and hence e = 0, 1. Thus 

msb(s) = msb(a 3 ) ® (msb(a 3 ) + msb(C 0 ) + e mod 2 32 ) 

and hence msb(s) can take only two values as determined by e. 

Thus, with respect to the known 32 most significant bits, equation [5] reduces 
to 


/ msb (2(a;i V Ci)a: 2 )\ 
msb(2x 2 (a:3 V C 3 )) 
msb (2(a; 3 V C 3 )ir 0 ) 

\ msb (2x 0 (x 1 V Ci)) / 


( msb(j/ 0 ) © msb(a; 0 ) ® msb(s) \ 

msb(yi) ffi msb(>i) ® (msb(s) A msb(a 0 )) 
msb(y 2 ) © msb(a; 2 ) ® (msb(s) A msb(oi)) I ' 
msb(y 3 ) ® msb^) ® (msb(s) A msb(a 2 )) ) 


Equation Q gives a relation between known quantities. Let Wo = 2xo, W\ = 
(, xi V Ci), W 2 = 2x 2 and W 3 = (x 3 V C 3 ). Also let K 0 = msb(t/ 0 ) © msb(x 0 ) ffi 
msb(s), K\ = msb(yi)®msb(xi)ffi(msb(s) A msb(ao)), K 2 = msb(y 2 )®msb(a; 2 )ffi 
(msb(s) A msb(ai)) and K 3 = msb(y 3 ) ® msb(a; 3 ) ® (msb(s) A msb(a 2 )). Our next 
step is to solve for W 0 , W \ , W 2 and W 3 such that 


msb(WiW2)=Ko,msb(W2W3)=Ki,msb(W 3 Wo)=K2,msb(WoWi)=K3. (7) 

Since there are two choices of e, the rest of the steps have to be carried out 
for each value of e. 

Step 2: 

We use Algorithm 1 to solve 0. There are, however, a few adjustments, which 
improve the run-time of Algorithm 1. Note that due to masking with Cl and C3, 
eight bits of each of Isb(Wi) and Isb(Ws) are fixed and known. Also Wo = 2xq. 
We know msb(xo) which means we do not know the last bit of msb(Wo) which 
is equal to the first bit of Isb(xo). To apply Algorithm 1 we have to know all the 
32 bits of msb(Wo). This means that we have to guess the last bit of msb(Wo). 
On the other hand, since Wo = 2xo, the last bit of Wo (and hence of Isb(Wo)) is 
zero. Similar considerations hold for W 2 . 

Now suppose we are solving for Isb(Wo) and Isb(Wi) from the equation 
msb(WoWi) = K 3 . While invoking Algorithm 1, we let Wl play the role of x 
and Wo play the role of y. Further, we choose n 2 = ni = 24 (Subcase 2a in 
Section HOI . Then in Algorithm 1, IC^I = 16, |Y(°)| = 24, |X(°)| = 16 and 
= 8. As mentioned before, due to the masking of W -b with Cl, four bits 
of each of U W and JfM are fixed to be one. Hence the number of choices of 
U W in Step 3 and in Step 9 of Algorithm 1 both reduces to 2 12 from 2 16 . 
The last bit of is zero and hence the number of choices of Y©- 1 in Step 5 
of Algorithm 1 reduces to 2 23 from 2 24 . The length of W© is eight. However, we 
also need to guess the last bit of msb(Wo), which is the next bit after W 1 ). Thus 
the number of possible choices of k© 1 ) in Step 9 of Algorithm 1 increases to 2 9 
from 2 s . 

In Step 18, Algorithm 1 produces (Isb(Wi), Isb(Wo)) as output. The modifica- 
tion described above also determines the last bit of msb(Wi). Suppose this bit 
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is b. By definition, the last bit of Isb(Wo) is zero. Then lsb(a;o) is obtained by 
prefixing b to Isb(Wo) and dropping the last bit. We assume that the modified 
Algorithm 1 produces (Isb(Wi), lsb(x 0 )) as output. Similar considerations hold 
for the other equations in 0 . 

Recall from Equation 0 that the original expression for the expected run- 
time of Algorithm 1 is R = 2^ (1) l (2^ (0) l +3 x 2l* (0) l x 2^ (1) l). Due to the 
changes in the number of possible choices of 17 W, y(°), and lA 1 ), as ex- 
plained above, this expression reduces to 

R = 2 16 ~ 4 (2 24 ~ 1 + 3 X 2 16-4 x 2 9 ) 

= 2 35 + 3 x 2 33 = 7 x 2 33 < 2 36 . 

The time for solving one equation in 0 is approximately 2 36 and hence 
the total time to solve all four equations is 2 38 . The solutions to 0 are stored 
in separate lists, as we explain below. Define Wi = Isb(Wi) for i = 1,3 and 
Wi = Isb(xi) for i = 0,2. 

• LstlO stores (wi,wo), sorted on wq , such that msb(WoWi) = K 3 . 

• Lstl2 stores (wi,Ws), sorted on such that msb(WiW 2 ) = K 0 . 

• Lst30 stores (w 3 ,wo), sorted on w 3 , such that msb{W 3 W 3 ) = K^. 

• Lst32 stores (w 3 ,W 2 ), sorted on w 3 , such that msb(W 2 W 3 ) = K\. 

Step 3: 

The next task is to “merge” the four lists to obtain solutions (wo,wi,W 2 ,w 3 ) 
which are consistent with all four equations. This is done as follows. 

• Merge LstlO and Lstl2 on w\ to obtain list Lstl02 
containing pairs of the form {wq, W 2 ,W\). 

• Merge Lst30 and Lst32 on W\ to obtain list Lst302 
containing pairs of the form (wo,W 2 ,w 3 ). 

• Sort each of Lstl02 and Lst302 on (w 0 , w 2 ). 

• Merge Lstl02 and Lst302 on (wq, W 2 ) to obtain a list Fin which contains 
tuples of the form ( wq,wi,W 2 ,w 3 ) which are solutions to 0. 

The time for merging and sorting (ignoring logarithmic factors) is 2 32 and 
hence the above steps can be completed in approximately 2 34 steps. 

We consider the expected number of solutions to 0. There are 24 unknown 
bits in each of Isb(Wi) and Isb(Ws). On the other hand, there are 31 unknown 
bits in each of Isb(Wo) and lsb(W 2 ). In addition, we have to determine the 
last bits of both msb(Wo) and msb(W 2 ). Thus there are a total of 112 unknown 
bits in 0. Each of the equations in 0 provide 32 restrictions on these unknown 
bits. Hence there are a total of 128 restrictions on these 112 unknown bits. Thus, 
on an average, we can expect the solution to 0 to be unique. See Section |5] for 
an emperical justification of this statement. 

Step 4: 

The list Fin contains the possible solutions (wo,u)i,W 2 ,w 3 ). Now Wi = Isb(Wj) 
for i = 1, 3 and we want lsb(x 7 ). As mentioned before, the masking of x\ and x 3 
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by Ci and C3 respectively fixes 8 bits each of W\ and W 3 . Thus from Isb(Wi) 
and IsbfR-'aj we do not obtain the values of these 16 bits of lsb(Vi ) and Isb(x 3 ). 
Instead, for each possible solution (uj 0 , wi, wj 2 , w 3 ) in Fin and each possible value 
of these 16 bits, we construct a possible solution (Isb(iro), lsb(a;i), Isbfa-g), lsb(x, 3 )) 
and verify it using the definition of the T-function given in © and a few more 
outputs of the pseudo-random generator. The expected number of solutions 
(lsb(a;o), Isb(cci), Isb(ar 2 ), Isb^)) is also one and the complexity of this step is 2 16 . 

This completes the description of the attack. By combining all the complex- 
ities, we see that the complexity of the attack is less than 2 40 in determining 
the 128 unknown bits of (lsb(:ro), lsb(a;i) , lsb(a; 2 ), lsb(# 3 )). This makes the at- 
tack quite practical and suggests that this T-function should not be used as a 
stand-alone pseudo-random generator. 


4.2 Attack on Squaring Based T— Function 

Consider the following T-function: 

( zo\ / x 0 ® s ® xj A M \ 
xi I _ I xi ® s A do © A M I 
X2 I \ X2 ® s A a% ffi x% A M I 
x 3 ) \i 3 ®sAa 2 ®ioAM/ 


(8) 


where, ao = xq, oq = oq_i Aaq, 1 < i < 4, s = 0:3® (03 + I), and M = 1. . . IIIO2. 
This is Equation (10) in [3]. Since, msb(ao) = msb(xo) and msb(ai) = msb(ai_i)A 
msb(xj), 1 < i < 4, we know msb(aj) for 0 < i < 4. Now, 

s = (msb(o 3 ) x 2 32 + lsb(a 3 )) ® (msb(a 3 ) x 2 32 + lsb(o 3 ) + l) 

= 2 32 {msb(a 3 ) ® (msb(a 3 ) + e)} + {lsb(a 3 ) ® (lsb(a 3 ) + 1 mod 2 32 )} 

where e is the carry of lsb(o3) + l. If e = 1, then Isb(a3) equals 1 . . . III2 = 2 32 — 1. 
But, lsb(o 3 ) = lsb(a;o) A lsb(a;i) A lsb(a:2) A Isb(xs) and hence Isb(xj) = 1 . . . III2 
for 0 < i < 4. In other words, e = 1 =k Isb(aq) = 1 . . . 1 1 12 for 0 < i < 4 and we 
can verify if this is indeed the case. 

If this is not the case, then e = 0 and so, msb(s) = msb(a3) ® msb(o3) = 
0 . . . 000 2 . But then, msb(s A a») = msb(s) A msb(aj) = 0 . . . 000 2 . Also, the 32 
most significant bits of M are all ones and hence, msb(a: A M ) = msb(a;) for all 
x. Hence, with respect to the 32 most significant bits, Equation flSJ) reduces to 


(x 0 \ 

( X 0 ® xl \ 

X1 

_ XI ® x\ 1 

X2 

1 X 2 ffi Xq 1 

\X 3 ) 

\X 3 ®xl) 



(9) 


with msb(xj) and msb(yj) known for 0 < i < 4. Let = msb(a;i_i) ® msb(j/j_i), 
where the computation on the subscripts is done modulo 4. Then Zi, 0 < i < 3 are 
known and we need to solve for ( xo,xi,X 2 ,x 3 ) such that the following equation 
holds for i = 0,1, 2, 3. 

msb ( xi mod 2 64 ) = z% 


(10) 
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We use Algorithm 2 to solve these four equations. Solving each equation takes 
time 5 x 2 16 < 2 19 (see Case 1 of Section [3]) and hence the time to solve all 
four equations is less than 2 21 . The possible solutions for Isb (rc 0 ) . Ist^aq), lsb(x 2 ) 
and Isb (£3) are kept in four lists L 0 , Lj, L 2 and L 3 respectively. Since n = 64 = 
2 x 32 = 2m, the expected number of entries in each list is one. We then form a 
list Fin which contains tuples (Isb(aro), lsb(a;i), lsb(a; 2 ), lsb(a;3)) such that lsb(ir,) 
is in L,. Then for each entry in Fin, we verify the solution by evolving the T- 
function in the forward direction a few times and comparing the output with 
the already available pseudo-random bits. 

Thus, we get an algorithm to determine the 128 unknown bits in the input of 
Equation (J8]) . It is easy to verify that the entire attack takes 2 21 time. This shows 
that the T-function based on squaring is completely insecure as a stand-alone 
pseudo-random generator. 

4.3 Extracting Lesser Bits 

In this subsection, we use the notation msb^x) (resp. Isb;.(a;)) to denote the k 
most (resp. least) significant bits of x. The state vector for the T-function in (J5J 
is (xq. Xi, ,'e 2 , £ 3). Suppose that instead of producing 128-bit output only the 64 
bits (msbi6(xo), msbi6(a:i), msbi6(a; 2 ), msbi6(a;3)) are produced as output. Thus 
there are 192 unknown bits in (a; 0 , xi, a: 2 , X 3 ) which have to be determined. We 
consider the effectiveness of our attack for this situation. The attack described 
in Section 14.11 goes through for this case. 

The complexity of the total attack depends on the complexity of solving 
Equation |7] We use Subcase lb of Section 12.11 along with the modification de- 
scribed in Step 2 of Section FTTl Then the run-time of the modified Algorithm 1 
becomes 2 16 ~ 4 (2 16 ~ 1 + 3 x 2 32-4 x 2 33 ) = 2 27 + 3 x 2 73 . The number of unknown 
bits in ([7]) is 2 X (48 — 8) + 2 X 48 = 176. The number of constraints in © is 

4 x 16 = 64. Hence the expected number of solutions in Fin is 2 112 . The correct 
solution can be determined by iterating the T-function and comparing the out- 
put with the available pseudo-random string. Thus the time taken to determine 
the 192 unknown bits will be 2 112 . Though this is infeasible in practice, it still 
constitutes a theoretical attack on the system. 

5 Implementation 

We have performed some experiments to verify some of the assumptions about 
the average case behaviour. In this section, we briefly describe these results. 

The first thing to consider is the expected number of solutions to Mult. As 
mentioned in Section [2 the expected number of solutions is 2 2n-3m . We de- 
scribe some experimental results for n = 16 and m = 8. The expected number 
of solutions is 2 8 = 256. The total number of possible instances z 1 ' 1 ' 1 ) 

is 2 24 . The number of instances such that the number of solutions is at most 
256 is around 55% of the total number of instances while the number of in- 
stances such that the number of solutions is at most 512 is more than 99%. The 
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maximum number of solutions occurs for the case (a^ 1 ), z^) = (0, 0, 0) and 

such pathological situations are extremely rare. 

We have implemented the attack on a reduced version of the multiplication 
based T-function described in Section 14.11 We have chosen the state vector to 
be four 32-bit words instead of four 64-bit words. Correspondingly, we have 
extracted the top 16 bits of each word. Also the constants C\ and C3 have been 
suitably scaled down. The attack has been implemented on randomly chosen 
instances and in each case the size of Fin was found to be one. This provided 2 8 
choices for the state vector and the unique one could be found using only one 
more block of the available pseudo-random bit string. Thus the attack worked 
extremely well with only three consecutive blocks of output. We expect the 
attack to scale up quite well when applied to the T-function having state vector 
consisting of four 64-bit words. 

For the problem on squaring, we have implemented Algorithm 2. In the case 
n = 64 and m = 32, the complexity of Algorithm 2 is 5 x 2 16 . Our experiments 
confirm this theoretical result and hence the attack on the squaring based T— 
function in Section 14.21 works as expected. 


6 Possible Countermeasure 

Our attacks show that T-functions are probably not secure enough for stand- 
alone use especially when half of the bits of the state vector are produced as 
output. As suggested by Klimov and Shamir, T-functions can be used in con- 
junction with S-boxes for design of stream ciphers. We provide one suggestion 
for possibly improving the security of T-functions while retaining some of the 
nice theoretical properties. 

There is a large and easily identifiable subclass C of T-functions such that 
any function in C defines a single cycle permutation on the state space. This is 
an attractive theoretical property. In our suggestion, we would like to preserve 
this property. To do this we apply the notion of conjugate permutations. (A 
similar idea has been used in the context of one-way permutations [5].) If 7r and 
t are any two permutations of a set S, then cr = r _1 o7ror has the same cycle 
structure as 7 r; further, a and 7r are called conjugate permutations. 

We apply it to the context of T-functions in the following manner. Suppose 
7 r is the permutation on the set of all state vectors induced by a T-function from 
C. Then 7r has a single cycle and any conjugate of 7r also has a single cycle. Note 
that this property does not depend on the choice of the permutation r. Hence 
we can choose r so as to improve the security of the overall mapping. 

In our attack, the basic weakness that we exploit is that there is insufficient 
intermixing of higher and lower bits. One simple operation which can help in 
improving such intermixing is the circular shift (which is not a T-function). Thus 
we can construct a permutation r on the state space by using circular shifts 
and other nonlinear operations. These operations can be arbitrarily chosen (in 
particular they need not be T-functions) to ensure higher security as long as r 
is a permutation and that they are efficient to apply. 
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One penalty for introducing this countermeasure will be reduction in speed. 
The exact amount of speed reduction will depend on the concrete proposal. 
Developing such a concrete proposal based on our guideline is a future research 
problem. 


7 Conclusion 

In this paper, we studied multiplication, squaring and T-functions. In the first 
part of the paper, we presented a time-memory trade-off algorithm to solve the 
problems of multiplication and squaring. These algorithms are used in the second 
part of the paper to analyse two concrete proposal of multi-word T-functions 
from [3], For the proposal based on multiplication, the 128 unknown bits of 
the state vector can be determined in 2 40 time while for the proposal based on 
squaring, these bits can be determined in 2 21 time. Experimental results from 
our implementation suggests that our attack works well in practice. Hence one 
can conclude that these two (and other similar) constructions of T-functions are 
not secure enough for stand-alone use. We also suggest the use of conjugate per- 
mutations for possibly improving the security of T-functions while maintaining 
some nice theoretical properties. 

Notes: An anonymous reviewer of the paper has suggested that the problems 
Mult and Sqr can be formulated as closest vector problems in a two-dimensional 
lattice. Using this approach, the time complexity of Algorithm 1 will be 2 32 with 
minimal storage space. At the time of preparing this final version, we have not 
been able to obtain the details of such an algorithm. We hope to present such 
details in a later communication. 
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Abstract. In this paper, we carefully study both distinguishing and 
key-recovery attacks against Bluetooth two-level EO given many short 
frames. Based on a flaw in the resynchronization of Bluetooth EO, we are 
able to fully exploit the largest bias of the finite state machine inside EO 
for our attacks. Our key-recovery attack works with 2 40 simple operations 
given the first 24 bits of 2 35 frames. Compared with all existing attacks 
against two-level EO, this is the best one so far. 


1 Background 

The short-range wireless technology Bluetooth uses the keystream generator EO 
to produce the keystream for encryption. After the earlier results [TUHHI)] of 
correlation (also called bias) properties inside the Finite State Machine (FSM) 
towards the one- level EO, most recently, m systematically studied the biases 
and proved two previously known large biases to be the only largest up to 26 
consecutive bits of the FSM output sequences. Attacks against EO mostly focus 
on one-level EO only and the best attacks mm work on one impractically long 
frame of keystream without exception. Nevertheless, a few attacks nmimm-9] 
apply to two-level EO; compared with feasible attack complexities on one-level 
EO, attack complexities on two-level EO are extremely high and make the prac- 
tical Bluetooth EO unbroken. 

The main contribution of this paper is that first based on one of the two 
largest biases inside the FSM within one- level EO, we identify the bias at two- 
level EO due to a resynchronization flaw in Bluetooth EO. Unlike the traditional 
approach to find the bias, the characterized bias does not involve the precompu- 
tation of the multiple polynomial with low weight. Second, to utilize the iden- 
tified bias, we develop a novel attack to directly recover the original encryption 
key for two-level EO without reconstructing the initial state of EO at the second 
level. Our key-recovery attack works with 2 40 simple operations given the first 
24 bits of 2 35 frames. Compared with all existing attacks [151ITTH 71-9] against 
two-level EO, this is the best so far. 
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the second level 




LFSr| » Q j H G 3 hH~^FSR] - 0 


Fig. 1. Diagram of two-level EO keystream generation 


The rest of the paper is structured as follows. In Section [2] we review de- 
scription of two-level EO. In Section [3] we study the attack against one-level EO. 
Then, we investigate the EO resynchronization flaw, which allows to develop the 
basic attack of previous section into the distinguishing and key-recovery attacks 
against two-level EO in Section 01 we further extend our key-recovery attack in 
Section |5] Finally, we conclude in Section |6] 

2 Preliminaries 

2.1 The Core of Bluetooth EO 

To briefly outline, the core of EO (both dashed boxes in Fig. 0]) can be viewed as a 
nonlinear filtering generator. The filtering generator consists of four 
LFSRs (i?i, . . . , Ra) which are equivalent to a single L-bit LFSR with connection 
polynomials p(x) and a 4-bit FSM, where L = 128. The keystream bit of the 
generator is obtained by xoring the output bit of the regularly-clocked LFSR 
with that of the FSM, which takes the current state of the LFSR as input and 
emits one bit (denoted by c( J in Bluetooth specification) out of its 4-bit memory. 

2.2 Review on Two-Level Bluetooth EO 

Let K c be the L-bit secret key computed by the key generation algorithm E3 [31 
p783]. According to [3], the effective key K. of length 8£ (1 < t < 16) is computed 

by 

JC(x) = K c (x) mod g[ e \x), 

where the polynomial g[^ (x) is specified in [3j p770] and has degree 8£. Bluetooth 
two-level EO (depicted in Fig. |T| uses two L-bit inputs: one is the known nonce[3 


1 Note that the connection polynomial of the equivalent single LFSR equals the 
product of those of the four LFSRs. 

2 By convention, hereafter we always use the superscript i to indicate the context of 
the *-th frame. 
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JP*, the other is the linearly expanded L-bit key K( from K. by K(,(a:) = g^\x) ■ 
K,(x), where the polynomial g% (x) is also specified in [3J p770] and has degree 
no larger than L — 8£; or equivalently, we can rewrite it as 

k; = e (/ c ), (i) 

where E is a linear mapping. After initialization of the equivalent LFSR for the 
first level EO, we can express its initial stat^l P[_ 19g 1 ,- 200 ] = (P- 1991 . . . , 

R 1 l- 200 ) as 

*f-199,...,L-200] = Gl(K') © G 2 (P i ), (2) 

for i = X, . . . , m, where Gi and G 2 are affine transformations over GF(2') L . Next 
comes the so-called two-level EO: 

— During the first level, with the FSM initial state preset to zero, EO runs L 

clocks producing 200 -bit output SI = R\ © a\ and updating q by 

= M(P| t )t+L .. j-) for t = —199, ... ,0, where M is the linear 
mapping over GF(2) L that corresponds to the companion matrix associ- 
ated with p(x). Note that first, a\ is the output bit of the FSM fed with 
R\t,...,t+L- 1 ] l second, the last L-bit output at the first level EO is 
last, Pf 1 _ i) i0] = (M 72 o G0(Kg © (M 72 o G 2 )(P i ). 

— At the beginning of the second level, the equivalent single LFSR is initialized 
by Vj* L j = G- i {S^ l _ [j ^ 0 j), where G 3 : GP(2 ) 128 — > GP(2 ) 128 is another 
affine transformation (see [3J p772]); the FSM initial state at the second 
level remains the same as the one in the end of the first level. Note that the 
present time is t = 1 . 

— During the second level, for t = 1 , . . . , 2745, EO produces the keystream 
z l = VJ ® PI for encryption of the i-th frame and updates Vj® t+L- 1 ] by 
V [t+i,...,t+L\- 

2.3 An Important Note on G 3 

We observe that G 3 is implemented in such a simple waj0 that the last L-bit 
output sequence of the first level EO is byte-wise reloaded into the four component 
LFSRs in parallel at the second level EO with only a few exceptions, which turns 
out to be a flaw as introduced later in Section |H For completeness, Table Q] lists 
in time order the first 24 output bits of Ri , . . . , R4 individually at the beginning 
of EO level two, in terms of the L-bit input no, ... , nn-i- 

2.4 The Bias Inside the FSM 

Our starting point would be the bias inside the FSM, which was discovered 
by MM an< l further proved in [T2] to be the the largest bias up to 26-bit output 


3 Throughout the rest of the paper, we use the unified notation ^ with the 
formatted subscript to denote the vector (D® , . . . , DJ). 

4 It is believed to help increase the rate of keystream generation. 


Y. Lu and S. Vaudenay 


Table 1. The first 24 output bits of LFSRs at EO level two 


IJLFSR ( _ output bits 


Ri 

V7I ••• V 64 , U39 ••• V32, V 7 ■■■Vo 

R .2 

V79 ■■■ V72, V47 ••■ Vio, «15 ' ' ' V 8 

Rs 

Ulll • ■ • V 104 , V87 ■■■ U 80 , V55 ••■ V48 

Ri 

U119 • • • W112, U 95 • • ' V88, V63 •■• V50 


sequence of the FSM involving the smallest number of consecutive bits. Let 
A = we have 

Pr(c° © c° t+1 0 c° +2 0 c° + 3 0 c° +4 = 1) = * + ~, 

for any integer t, assuming that the L + 4 = 132-bit initial state of EO is ran- 
dom and uniformly distributed. Hereafter, we analyze as exactly described in 
Bluetooth specification [3] . For convenience, we denote c° used for the first and 
second level keystream generation by a\, respectively. Therefore {at*}, {PI} 
being separated sequences of {c° } both satisfy the same statistical property: 


Pr(a} 0 al + 

i * 1 A 

L 0 a\ +2 0 a\ +3 0 aJ +4 = 1) = - + 

(3) 

Pr 09* 0 (3 1 + 

1 © 0t+ 2 © Pl + 3 © $+4 = 1 ') = \ + \' 

(4) 


for any t and any i. 


3 Security Analysis on EO Level One 

The goal of the attacker in this section is to recover the effective 8Lbit encryption 
key K with knowledge of to L-bit output sequences 5| ;1 _ L Q j of the first level 
EO for i = 1, . . . , to and the corresponding to nonces P 1 , , P m . 

3.1 Finding the Closest Sequences with Fixed Differences 

We begin with a very simple problem: given 2m L-bit sequences s 1 , . . . , s m and 
6 1 , . . . , 6 m , where 6 1 = 0 and 6 l ^ & for all* / find the L-bit sequence r 1 
that maximizes Nfr 1 ) = Y^Li 2t=i( s t ® r t ) where r| = rj 0 <5} for i = 1, . . . , to 
and t = 1, . . . ,L. 

Similar to the well-known approach (see [3J p251]), the solution based on the 
idea of minority vote goes fairly easy. We have 

L m 

t—i i = i 

Thus, in order to maximize N(r 1 ), we must have 

r\ = minority{sj 0 8\ : i = 1, . . . , to} 
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for all t = 1 , ,L. Note that in case of a tie for r \ , we have two answers for 
this f-th bit regardless of all the other bits. We finally obtain all the answers 
that achieve the same maximal iVfy 1 ). The time and memory complexities of 
the above algorithm both equal the data complexity 0(mL). 

3.2 Attack Against EO Level One 

Let ...,o] ® #[i _x, o] for i = 1, ■ • .,m. By Eq.® we have 

A\ x _ l j0] = {M 72 o G 2 ){P 1 ® P i ). We further set 

r t = ® R t+j> 
j=0 



for i = 1, . . . , m and t = 1 — L , . . . , —4. Note that s\®r\ *= ®^ =0 a.\ +] follows the 
biased distribution by Eq.([3]). As long as Y^iLi J27 =i-l( s I ® r t) is the maximal 
and A\,Sl are known, we can apply the preceding algorithm to recover (L — 
4) bits of r 1 followed by an exhaustive search on the remaining 4 bits, next 
solve R 1 , then K' c by Eq.j2]). and finally deduce K. from K^. by Eq. (JTJ) . The 
time/memory/data complexities all equal 0(mL + 2 4 L), i.e. 0((rn + 16)L). No 
precomputation is needed. 

About the minimal m to guarantee the valid precondition St^i-i,( s t® 
r\) is the maximal, we use the result in [T^l Eq.(10)] based on [5] that says 
regardless of the value of L and l, we need the minimum 

4 log 2 

m ^ — (frames). (5) 

Consequently, we require m = 512 to recover /C from S l and P‘ for i = 
1, . . . , m. This results in the time/data/memory complexities all the same as 
0(2 16 ). To verify this, we ran experiments on 512 frames of the randomly-chosen 
132-bit EO initial state 2 25 times. It turned out that we had 1.5 errors and 0.4 
tie in average, which means we can easily correct all errors by an extra checking 
step in the end in negligible time. Finally, Table [2] compares our result with 
the only knowr0 four attacks |7l[8l[IIJ[l5] working on frames of L-bit consecutive 
keystreams. Note that existing attacks [71181 HT1IT5] directly apply to two-level EO 


5 In the similar approached paper [9], m is chosen as 45 for EO level one without the 
complexity estimate, because the authors focused on the two-level EO and traded m 
with the time complexity of EO level one, whose time complexity is negligible with 
that of the EO level two. 
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as well with the level- by-level key-recovery scheme^; in contrast, our attack is 
completely disabled against two-level EO with this scheme as the attack is based 
on a naive assumption that we directly observe the output of EO level on<{[]. In 
the next section, we introduce a resynchronization flaw in Bluetooth EO that 
leads to a shortcut extended attack against the two-level EO. 

Table 2. Comparison of our attack with existing attacks against EO level one given 
frames of L bits 


Attack Type 1 1 Precomputation | Time | Frames | Data | Memory 1 1 


Divide & Conquer 

nu 


2 ya 

1 

2 6 7 


BDD 

41. 


2" 

1 

2 1 * 


Algebraic Attack 

m 


2 bi 

2 

Y 

2 bi 

Algebraic Attack 

IS] 


2 JJ ' 4 

3 

2 8b 

2^3.4 

Our Correlation Attack 


2 10 

2 a 

2 ib 

2 id 


4 Security Analysis on Two-Level EO 

4.1 The Resynchronization Flaw in Bluetooth Two-Level EO 

Define 

U i = (Ui,...,Ui) = G 3 (R\ 1 _ L ^ 0] ). (6) 

Following the description of G3 in Subsection 12.31 we can easily verify that 

V t l = Ul ® a*_ 56 _ t © a l _ 48 _ t © for t = 1, . . . , 8, 

V t l = Ul © a l _ 80 _ t © cd_72_t © a!_32 _ t © a!_ 2 4-t, for t = 9, . . . , 16, 

V t z = Ul © a!_ 104 _ t © o!_9 6 _ t © ol 1 _ 56 _ t ffi o;!_4 8 _ t , for t = 17, . . . , 24. 

From the above equations, we summarize the characteristics of V f ‘ by 

Vt = Ul © a’ 0( © oi l at+ 8 © a\ t © al t+ 8 , (7) 

for t = 1, ... ,24, where a t = —t + const ^t-ij and b t = — t + const Note 
that Eq. ((Tj) is our crucial observation about Bluetooth EO resynchronization flaw 
which enables a shortcut attack throughout the two levels of EO. Now, we express 
the output bit z\ of the second level EO keystream by 

z\ = Ul © a\ t © a' t+8 © a\ t © a|, t+8 © (8) 


6 namely, the initial state at the first level is reconstructed after the initial state at 
the second level is recovered. 

7 As a matter of fact, according to 0 p763] , Bluetooth takes the correlation properties 

into account and adopts the two-level scheme of keystream generation in practice on 

purpose. 
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for t - 1, . . . , 24. Let u\ = ®^ =0 U'l +] and s\ = ®^ =0 z\ + y From Eq.flH), we 
have that 

S t © U t = 0 a a t -j © 0 a at-j + 8 © 0 a bt-j © 0 a b t -j + 8 © 0 Pt+j ( 9 ) 
3 = 0 .7=0 j = 0 j = 0 3=0 

for t = 8k + 1, . . . , 8k + 4, k = 0,1, 2. Therefore, we deduce an important corre- 
lation concerning the practical implementation of EO from Eq. (1314191) : 

Theorem 1. Assuming independence of a\’s and 01 ’s, we have 
Fr( S j©t4 = l} = | + ^ 
for t = 8k + 1, . . . ,8k + 4, k = 0, 1, 2. 

4.2 A Near-Practical Distinguishing Attack Against Two-Level EO 

Using the standard technique of linear cryptanalysis, we expect that s\ © u\ 
equals one most of the time for t = 8k + 1, . . . , 8k + 4, k = 0,1,2 with a total of 
A -10 « 2 34 samples. Since the difference 

u* © IP = G3(4_ l ,..., q] ) © G 3 (4_ l ,... )0] ) = (G 3 o M 72 O G 2 )(P i © F), 
is known for all i and j by Eq. (l2l6l) . we apply the algorithm in Subsection l3.2l to 
recover the bit u\ separately with two sets of 2 34 frames sharing only one common 
frame denoted as the first frame for both sets. If we get a unique solution, we 
conclude the keystreams are generated by EO; otherwise, we accept them as truly 
random sources. The time/data complexities are 0(2 x 2 34 x 5), i.e. 0(2 37 ). In 
contrast to the conventional treatment based on finding a multiple polynomial 
with low weight, no precomputation is needed in our scenario. So far, this is the 
only known near-practical attack against the full two-level EO. We can further 
improve the distinguisher by recovering uj for t = 1 ..... 4 with two different sets 
of frames of the first 8 bits. Comparing two sets of solutions for the four bits, if we 
get a majority of identical bits, then we conclude the keystreams are generated 
by EO, otherwise we accept them as truly random sources. The number of frames 
we need is 2 x 2 34 /4 = 2 33 . This results in time/data complexities 0(2 33 x 8), 
i.e. 0(2 36 ). 

4.3 The Key-Recovery Attack Against Two-Level E0 

From last subsection and Theorem[lJ we know that with 2 34 frames of keystreams, 
we can recover twelve bits, i.e. uj for t = 8/c+l, . . . , 8/c+4, k = 0, 1, 2. After that, 
we try exhaustively for the remaining |/C| — 12 bits assuming linear independency 
of the twelve bitqj- Note that we have 

IP = ( G 3 o M 72 o GjXK'J © (G 3 o M 72 o G 2 )(F), (10) 


8 We tested and found that the twelve bits are linearly independent for all choices of 
effective keylength |/C| = 8f! except for |/C| = 8 in which case our attack is worse 
than the brute force attack and becomes meaningless anyway. 


490 Y. Lu and S. Vaudenay 


by En. (l6l2l) . So, we deduce from Ea. dlOllIl that 

IP = (G 3 o M 72 o Gi o E)(K) © (G 3 ° M 72 o G 2 )(P i ), 


which means U l is an affine transformation of /C given P' and so is u l . Thus, we 
can ultimately solve the effective key /C from u l . The total time complexity of 
our attack is computed as 


; 4 + 2 |/C| — I 3 = 


2 34 , |/C| < 48 

2 |K:| “ 13 , jjcj > 48 


The data complexity of our attack is (2 34 — 1) • 24 + 128, i.e. 0(2 38 6 ), as 
we need 2 34 — 1 frames of the first 24 bits plus one frame of 128 bits. Table |3] 
compares our attack with existing attacks [T5J1II1E11E11H] against the two-level 
Bluetooth E0. Note that the number of required frames completely depends on 
the frame size in [7] to meet the requirement of data amount. This is, to our 
best knowledge, the first non-trivia^] attack against practical E0 with various key 
length. Notice that when 40 < |/C | < 80, our attack offers the best performance 
over the others. 


Table 3. Comparison of our attack with existing attacks against two-level Bluetooth E0 


Attack 

Precomputation 

Time 

Frames 

Data 

Memory 

exhaustive search 


2 |X|-i 

1 

|£| 


[T5] 


2 a3 

1 

2 1 


m 


2“ 3 

1 

2 7 


m 


2 ,A 


2 « 

2 bi 

0 

2 SU 

2 oa 

2 

2 i2 ' 4 

2 »u 

[ 5 ] 

2 »u 

2 vu 

45 

2 iv 

2 »u 

Our Attack 


2 |/C| — 13 _j_ 2 34 

2 34 

2 38.6 

2 34 


Remark 2. Note that our attack is based on one of the largest two (linearly 
dependent) biases which is introduced in Eq.(J3}. As time/data tradeoff, we 
might also expect to have some other linearly independent biases to be large 
enough so that the time is decreased at somewhat reasonably increasing cost of 
data/memory complexities. Nonetheless, using the computation formula of [T2] . 
we find none such bias that leads to the data complexity of less than 2 50 . 

Remark 3. As the nonces P l 's are affine transformation of a 26-bit clock and 
a master device address, our attack requiring much more than 2 26 frames of 
keystreams still remains impractical unfortunately. 


contrast to the brute force attack. 
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5 Extended Key-Recovery Attack Against Two-Level EO 

5.1 A Partial Key-Recovery Attack 

Notice that on one hand, each of the four leftmost biased bits on the right-hand 
side of Eq. © is computed only with a certain subset of fixed key bits, the known 
nonce and the unknown variable FSM initial state; on the other hand, the value of 
Eq.© can be easily predetermined from the left-hand side, after we recover u z t ’s 
with 2 34 frames by the distinguisher in Subsection 14.21 Consequently, the well- 
known technique of statistical cryptanalysis leads us to the following approach 
to advance our key-recovery attack: supposing we manage to guess one of those 
four biased bits for all frames by guessing only the related key bits, then, for 
each frame, we XOR the guess on the biased bit with the predetermined value 
of Eq.© to obtain one bit. Thanks to Eq.©, this bit shows bias for the right 
guess and almost balancedness for the wrong guess (which is also called statistical 
distinguishable) ; we’re able to spot out the right guess of all guesses finally. 



More specifically, we observe two important points about EO FSM state: first, 
the FSM state at time t always contains the two bits c° , c® _ x ; second, the 4-bit 
FSM state is updated by its current state together with four current output bits 
of LFSRs. Therefore, for fixed t € {8k + 1, . . . , 8k + 4} and k e {0, 1, 2}, the 
bi® © - =0 Q* t _ ? computed from 5 consecutive bits a l at , . . . , a^_ 4 , is derived 
from the same subset of 4 x 3 = 12 bits of the shared key K in all frames given 
P l together with the unknown frame-dependent FSM state at time a t — 3 (see 


10 For our convenience, we discuss the first biased bit on the right-hand side of Eq. © 
from now on; however, due to symmetry of the subscripts on the right-hand side of 
Eq.©, our discussion also applies to the other three biased bits but the last. 
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Fig. [2]). We can compute all the possible sequence^ a ' at , . . . , ol at _ 2 in according 
to every possible FSM state for each frame i with t G {8/c + 1. . . . , 8k + 4} and 
k G {0, 1, 2}. Within one frame, of all the choices of 12-bit K' of /C and the FSM 
state, the sequence computed with the right shared 12-bit K and the right FSM 
state yields ®^ =0 a^, which equals ®^ =0 (o4 t _ j+8 © a\ H _ j 0 a£ t _ j+g 0 j3\ +j ) 
with bias A 4 when xoring with the computable bit s\ 0 u\ by Eq.©; meanwhile, 
the sequence obtained with the wrong FSM state and/or the wrong shared 12-bit 
K' is expected to produce a new biased bit ®^ =0 a ' at -j (with bias A) which when 
xoring with s\ 0 u\ finally generates a bit with much smaller bias A 6 that could 
be approximated by a randomly and uniformly distributed bit. Therefore, we 
estimate that for every frame, the 12-bit guess K' would yield 2 4 randomly and 
uniformly distributed bits, except for the correct guess that produces 2 4 — 1 = 15 
randomly and uniformly distributed bits as well as one biased bit (with bias A 4 ) . 

Alternatively, for every frame i, we can guess 4(2 + r) bits K' of K. to- 
gether with the FSM state at time a t — r — 2 to compute consecutively r 
bits ®^ =0 o/ at _j,..., ®-_ 0 a' 0i _, J _ T+ - l with r < 5 — (f mod 8) for fixed t G 
{8 k + 1, . . . , 8A; + 4} and k G {0, 1, 2}. Denote the parameter m as the required 
number of frames to be discussed later. For the same reason as before, when we 
xor the r bits with sj 0 u\, . . . , s\ +T _ l 0 u l t+T _ t , we expect the 16m sequences 
to comply with a truly random distribution Vq of T-bit vectors for all wrong 
guesses K and the 16m sequences for the right guess K to comply with the 
biased distribution V\ of r-bit vectors approximated by 


£>i 


V + 15T> 0 
16 


( 11 ) 


where V = f V® 4 with 0 representing the regular convolutional product (see jT2]), 
and V is the distribution of ® 4 =0 c^-, . . . , ®^ =0 Cj_ T _ 5 - +1 . Note that Ea.flTTl) 
means all the biases in V dwindles 16 times in V i, i.e. we have the following 
relation between the two Walsh coefficients V\ (x),'D'(x) of any nonzero T-bit 
vector x : 

A(X) = (12) 

Let / : GF( 2) T -> R be a weighted grade for those resultant sequences 
, . . • , Xk™ from the guess K'. We accordingly grade each guess K' by 


G K ‘ = Y.f(x j K 


(13) 


Using analysis of [TS] and [2] (see Appendix for complete treatment), we show 
that with minimal 

m ~ T + 2 9 34. 5 


We omit the superscript i and use a[ to denote the candidate for a\. 
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the score Gk of the right guess tops the chart by choosing f(x) = T>i(x) — yg for 
all x e GF{ 2) T . Note that with f(x) = V'(x) we obtain equivalently the same 
resultant score G K ' for all K' . Also, recall that to predetermine , u\ +T _ 1 

we need 2 34 frames for the distinguisher. Thus we must have 



(14) 


Algorithm Q] details the above partial key-recovery attack for 4(2 + t) bits. 


Algorithm 1 The extended attack against two-level EO to recover 4(2 + r) bits 
Parameters: 

1: T>i by Eq.JTIJ 
2: t € [1,4] 

3: m by Eg. (ITU) 

4: keystreams z\ ■ ■ ■ 224 generated by the same K. together with P’ under two-level EO 
for i = 1, . . . , m 

Processing: 

5: choose k 6 {0, 1, 2} and t £ {8fc + 1, . . . , 8k + 4} with r < 5 — (t mod 8) 

6: for 4(2 + r) bits K' of JC that are used to compute a' at _ T _!, . . . , a' at and are 
consistent with previously recovered bits do 
7: initialize Gk' to zero 

8: for i=l,...,mdo 

9: initialize counters (i o,jui,..., p,2 T -i to zero 

10: for all 4-bit FSM state at time a t — r — 2 do 

11: compute aa t _ T _!, ..., a„ t 

12: compute b = bo , ... , 6 T -i with b n = u\ +n © © 0 J=O a' at _j_ n 

13: increment 

14: end for 

15: increment G K ' by Y^b — 11) 

16: end for 

17: add the pair ( Gk',K ') into the list 

18: end for 

19: find the largest Gk in the list and output K 


5.2 Complexities and Optimization Issues 

About the performance of the partial key-recovery attack, it is seen from Algo- 
rithm[T]that to recover 4(2+r) bits, it rims 2 4 ( 2+T bm-2 4 (2+r) = m(2+r)-2 12+4r 
times to compute each a' t for grading 2 4 ( 2+r) candidates. In total, we have to 
perform T = m(2 + r) • 2 12+4r operations, where m is set by Ea.(IT4l). 

Additionally, the loop from Line 9 to Line 15 can be done by one oper- 
ation after precomputation as detailed below, which makes T = m ■ 2‘ i< - 2+T K 
During preprocessing, we run through every y at -i, ■ ■ ■ , Uat-r-i (where y t de- 
notes the Hamming weight of the original four component LFSRs’ output bits 
at time t) to compute the 2 4 possible sequences a' at . . . . . oi at _ T _ x which yield 
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2 4 sequences b' = 0 J=O C( at _p .... 0 J=O a4 t _ 7 _ r+1 accordingly; and then for 
each r-bit b ", we increment the counter last, we build up a table to 

store h(y at -i , . . . ,y at _ r _ 2 ; b ") = Y,v Pb'mb" (®i ( s ' ® & ") ~ 4)- The precompu- 
tation needs memory 2 r • 5 2+T « 2 3 ' 32t+ 4 ' 6 and time 2 4 • 5 2+T ■ (2 + r) ■ 2 T w 
(r + 2)2 3 - 32r+8 ' 6 . After that, in real-time processing, for each frame i, we just 
compute b 1 = b l 0 , . . . , b 1 T _ 1 with b % n = u\ +n ® s| + „ for n = 0, . . . , r — 1, deduce 
y l at _ i, . . . , y l at _ T _ 2 from K ' , P 1 and increment Gk 1 by h(y l at _ 1 , . . . , y* t _ T _ 2 ; b l ). 
Thus, we get T = m ■ 2^ 2+T \ 

Moreover, when 2 4 ( 2+T ) • 2 T < m, i.e. 2 8+5t < m, we can further reduce T 
down to m + 2 16+9t . Notice that it is the same subset of 4(2 + r)-bit fi l of P l 
that is used to compute y l = i, . . . , y l at _ T _ 2 ) with K' . For convenience, let 
g : GF(2) l ^ GF( 2) 4 ( 2+T ) map P l to f2 l . We precompute a table h'(Q, q ) for 
every 4(2 + r)-bit fl and r-bit q defined by: 

h'{G,q) = ^2 l n=g ^ P i )jq=u i 9s i 

with u l = ( u \ , . . . , u \ +T _ 1 ) and s 1 = (sj, . . . , sj +r _ 1 ). This takes time O(m) with 
memory 0(2 8+5t ). Recall that u l is determined independent of K' by the distin- 
guisher in Subsection 14.21 and u'\ s 1 ■y 1 completely determine how to increment 
G K ' for frame *, i.e. by h(y‘: u t (Bs i ) from last paragraph. So, in real-time process- 
ing, for every K ' , instead of processing frame by frame to update Gk 1 , we simply 
go through every (8 + 5r)-bit pair (/?, q), deduce y = (y at - i, ■ . . , y at - T - 2 ) from 
fi and K ' , then increment G k> by h' {Q, q)h(y ; q). We reach the time complexity 
T = m+ 2 4 ( 2+t ) ■ 2 8+5t = m + 2 16+9t for 2 8+5t < m. 

To summarize, we have T = m+2^ 2+T ^ -min(m, 2 8+5r ). Tabled lists the best 
complexities of our partial key-recovery attack corresponding to r = 1, ... ,4. 
Note that the success probability of the attack in the table is estimated according 
to the hypothesis test result of Eq. (HU), i.e. the percentage of the 4(2 + T)-bit 
keys to generate a non-uniformly distributed sequence a ' at _ T _ 3 , . . . , a' at with all 
the possible FSM state. 

5.3 The Overall Key-Recovery Attack 

Now we discuss how we proceed with the optimized Algorithm Q] to recover the 
full 1C. With r = 2 and fixed k, we independently run Algorithm [T] three times 
with t = 8k + 1, . . . , 8k + 3. And we expect at least two successes out of three 


Table 4. Performance of our partial key-recovery attack against two-level E0 


r 

Frames 

Time 

T 

Prob. of 
Success 

recovered key bits 

4(2 + r) 

1 

2 m 

2 Jb 

50.8% 

12 

2 


2 Jb 

87.0% 

16 

3 

2 S4.b 

2 43 

99.0% 

20 

4 

2 MJ 

2 b2 

99.9% 

24 
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runs. After checking consistency of all the overlapping bits for every possible 
pair of the algorithm outputs, we identify all the successful runs and obtain the 
minimum 16 + 4 = 20 key bits. 

We can easily adjust Algorithm Q] to target at any of the middle three biased 
bits on the right-hand side of Eq. © to recover 16 bits. With each modified partial 
key-recovery algorithm, we repeat previous procedure to recover minimum 20 
bits. In total, we are sure to gather 4 x 20 = 80 bits. Since we already have 12 bits 
by the distinguisher, we finally exhaustively search the remaining L— 80— 12 = 36 
bits within one frame. Algorithm [U gives the abstract strategy of our complete 
attack. Therefore, to recover L-bit 1C, our key-recovery attack works on m = 2 35 
frames, in time 24m+4x 3x 2 35 ~ 2 40 . The comparison of our attack with the best 
known attacks [7j[8j[9] against two-level E0 for |/C| = L is available in Table [5] 

Table 5. Comparison of our attack with the best attacks [7-9] against two- level E0 
for \K\=L 


Attack 1 1 Precomputation | Time | Frames | Data | Memory 1 1 


m 


2 73 


2 43 

2 bi 

m 

2 »u 

2 bb 

2 

2 1J.4 

2 »u 


2 »u 

2 <u 

45 

2 1 ' 

2 »u 

Our Attack 


2 4U 

2 35 

2 3y ’ b 

2 Jb 


Algorithm 2 The abstract of the complete attack against two-level E0 for 

\K\=L 

Parameters: 

1: m by EmlTH 

2: m frames of 24-bit keystreams generated by the same K. together with known nonces 
under two-level E0 
Processing: 

3: for each of the leftmost four biased bits on right-hand side of Eq.© do 
4: choose fee {0, 1, 2} and set r = 2 

5: for t = 8k + 1, 8fe + 2, 8fe + 3 do 

6: use the optimized partial key-recovery attack to obtain 16 bits 

7: end for 

8: checking consistency among pairs of those 16 bits to obtain minimum 20-bit K. 

9: end for 

10: exhaustively search the remaining 36 key bits within one frame 
11: output the L-bit K. 


6 Conclusion 

In this paper, based on one of the two largest biases inside the FSM within 
one-level E0, for the first time, we identify the bias at two-level E0 due to a 
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resynchronization flaw in Bluetooth EO. Unlike the traditional approach to find 
the bias, the characterized bias does not involve the precomputation of the mul- 
tiple polynomial with low weight. Second, to utilize the identified bias, we de- 
velop a novel attack to directly recover the original encryption key for two-level 
EO without reconstructing the initial state of EO at the second level. Our key- 
recovery attack works with 2 40 simple operations given the first 24 bits of 2 35 
frames. Compared with all existing attacks |15j[IIJ|7l[8l|9] against two-level Blue- 
tooth EO, this is the best one so far, although the impossibly high amount of 
frames thwarts our attack to be practical. It remains an open challenge to de- 
crease the data complexity with practical time and memory complexities. Finally, 
our attack illustrates the theory of statistical attacks in mm with an example 
which is not based on linear cryptanalysis. 
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Appendix 

All our analysis here is similar with [16] and inspired by [2]. First, by Ea. (fT3]) . 
we have 


Exp(G*,)= £/(*>) 


for a random wrong guess K ' , and by Ea.flTTll we have 


Ex P (G_r-) = — ™^/(&) +m^T> , (6)/(h), 

b b 


for the right K. Hence, 



(15) 


Meanwhile, we compute the variance of Gk 1 as 


(?'») 


2 


Var (G KI ) = L ^j:m) 2 -^[T / m 


(16) 


We can estimate the rank of Gk over all possible Gk 1 by 



(17) 


In order to achieve the top rank for Gk, we see that the fraction 
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^Exp(GW') 

\/Var(G^) 


(18) 


must be large enough. This can be satisfied as long as the number m of avail- 
able frames is sufficiently large. However, aiming at a practical attack, we are 
concerned with the question of how to choose / in order to minimize m under 
the constraint of the top rank Gk ■ In order to maximize the fraction (HU), we 
first maximize the numerator with the constraint that the denominator is a con- 
stant and then try to maximize the fraction over all the solutions. Define the 
multivariate polynomial 

9, = (v [b ) - i) m + E mf - ^ (z m) ’ ■ 

Using Lagrange’s multiplier, we have 


for all b 6 GF( 2) T . From Eg . (THU) we infer that 


m-m 

v(b)-v(b 0 


= const. 


for all b / U. Therefore we have a universal expression of / as 


f(b) — const. 


= const'. 


for all b G GF( 2) T , which yields the same quantity of (H5|l regardless of the 
constants in /. So the easiest way to define / could be f(b) = D' (6) — ^ for all 
b € GF(2) T . Then Ea. (fT5l) reduces to 

aemgk') = (v(b) - 4) 

= PEH) 8 

6/0 

«P(2r-l)A 8 . 


On the other hand Eq. (|T6l) reduces to 


Yar(G K 0«^(2r-l)A 8 . 
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So we deduce from Eq. ifTTJi that 


Exp(RankG K ) » 

2 4(2+r) ^ n 

w “7ir e ~ 64 • 

This means Ranker is expected to top the chart with 

_ 256(2 + t) log 2 ^ t + 2 34 5 

A 8 (2r — 1) 2r-l ' 
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Abstract. It is almost a folklore-knowledge that hash-based time-stam- 
ping schemes are secure if the underlying hash function is collision- 
resistant but still no rigorous proofs have been published. We try to 
establish such proof and conclude that the existing security conditions 
are improper because they ignore precomputations by adversaries. After 
analyzing a simplistic patent filing scenario, we suggest a new security 
condition for time-stamping schemes that leads to a new security prop- 
erty of hash functions - chain-resistance. We observe that if the variety 
of possible shapes of hash-chains is polynomial (and the verification pro- 
cedure is suitably improved), then the time-stamping scheme becomes 
provably secure, assuming that the underlying hash function is collision- 
resistant. Finally, we show that in some sense, the restrictions in the 
security definition are necessary - conventional black-box techniques are 
unable to prove that chain-resistance follows from collision-resistance. 

1 Introduction 

The main goal of digital time-stamping is to prove that electronic data-items 
were created or registered at a certain time. A simple method is to use a trusted 
service (with a precise clock) that provides data items with current time value 
and digitally signs them. The assumption of unconditionally trusted service hides 
a risk of possible collusions that may not be acceptable in applications. The risks 
are especially high in centralized applications like electronic patent- or tax filing 
as well as in electronic voting, where the possible collusions are related to direct 
monetary (or even political) interests. 

First attempts to eliminate trusted services from time-stamping schemes were 
made in (J, where cryptographic hash functions and publishing were used to 
replace electronic signatures. To date, several improvements of hash-based time- 
stamping schemes have been presented [1-3]. Such schemes have been used in 
business applications and are even included in international standards [§]. 

The combined monetary value of electronic content (insured, in particular, 
with time stamps) increases over time and so does the risk associated with it. A 
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decision of a content manager to start using a certain time-stamping service for 
protecting electronic records must involve the assessment of long-term security 
risks. Desirably, such assessments should be based on analytical arguments. As 
an example of such argument, modern cryptography can prove that there are 
no structural flaws (or principal design errors ) in security solutions, assuming 
that their basic building blocks (such as hash functions) are secure. The use of 
provably secure time-stamping schemes can avoid many practical risks. 

Regardless of the growing importance of hash-based time-stamping schemes, 
their security is only superficially studied in scientific literature. In [5], a formal 
security condition for hash-based time-stamping schemes was presented and an 
informal sketch of a security proof was outlined. Though no rigorous proofs were 
presented it has become almost a public myth that the security of hash-based 
time-stamping schemes can be reduced to the collision-resistance of underlying 
hash functions. Thus far, no more related studies have been published. 

In this paper, we revisit the security analysis of hash-based time-stamping 
schemes (5]. We observe that the formal security condition stated in [5] is un- 
reachably strong because it overlooks pre-computations of the adversary. 

Inspired by a simplistic patent filing scenario, we present a new security 
condition for time-stamping schemes that leads to a new security condition for 
hash functions - chain-resistance - necessary for the scheme [5] to be secure. We 
show that additional checks in the verifying procedure render the conventional 
time-stamping schemes provably secure in the new sense, based on collision- 
resistance of the hash function. The additions concern an examination of whether 
the shape of the hash-chain included into a time stamp belongs to a certain 
(polynomial) set of templates. This may seem a minor detail but as no currently 
used time-stamping schemes implement it, none of them are provably secure. 

We further examine the necessity of said additional checks in the verification 
procedure and prove that without these checks it is probably very hard (if not 
impossible) to prove the security of the schemes of type ffff based on collision- 
resistance alone. We present an oracle relative to which there exist collision- 
resistant hash functions which are not chain-resistant. Almost all security proofs 
relativize - are valid relative to any oracle. Therefore, any security proof of the 
unmodified schemes should use either non-standard (non-relativizing) proof tech- 
niques or stronger/incomparable security assumptions on the underlying hash 
function. For example, it is easy to prove that entirely random hash functions 
( random oracles) are chain-resistant. In practice, it is often assumed that SHA-1 
and other hash functions behave like random oracles which means that in such 
setting, their use in practical time-stamping schemes is justified. At the same 
time, it is still possible that a time-stamping scheme that uses SHA-1 is totally 
insecure while no collisions are found for SHA-1. 


2 Notation and Definitions 

By x «— V we mean that x is chosen randomly according to a distribution V. 
If A is a probabilistic function or a Turing machine, then x •*— A (y) means that 
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x is chosen according to the output distribution of A on an input y. By U n we 
denote the uniform distribution on {0, l} n . If T >\, . . . , D rn are distributions and 
F(x i, . . . ,x m ) is a predicate, then Pr^! <— Di,. . . ,x m <— D m : F(x i, . . . ,x m )\ 
denotes the probability that F( xi , . . . , x rn ) is true after the ordered assignment of 
xi, . . . , x m . We write f(k) = 0(g(k)) if there are c, ko £ R, so that f(k) < cg(k) 
(Vfc > k 0 ). We write f(k) = u(g(k)) if g(k) = 0(f(k)) but f(k) / £>{g(k)). 
A function /: N — > R is negligible if f(k) = k~ u ^. A Turing machine M is 
polynomial-time ( poly-time ) if it runs in time k°^\ where k denotes the input 
size. Let F* be the class of all functions /: {0, 1}* — » {0, 1}*. Let FP be the class of 
all functions f £ F* computable by poly-time Turing machines M. A distribution 
V on {0, 1}* is polynomially sampleable if it is an output distribution of a poly- 
time Turing machine. 

By an oracle Turing machine we mean an incompletely specified Turing ma- 
chine S that comprises calls to oracles. The description can be completed by 
defining the oracle as a function O £ F*. In this case, the machine is denoted 
by S°. An oracle O is not necessarily computable but may still have assigned 
a conditional (worst-case) running time t(k), which may or may not reflect the 
actual amount of computations performed by O internally. Running time of S° 
comprises the conditional worst-case running time t(k) of oracle calls - each call 
takes t(k) steps. An oracle O is poly-time if t(k) = k c><1 * . We say that S is a 
poly-time oracle machine , if the running time of S° is polynomial, whenever O 
is poly-time. Let FP* denote the class of all poly-time oracle machines. Let FP° 
be the class of all functions computable by poly-time oracle machines S° . 

A primitive fp is a class of (not necessarily computable by ordinary Turing 
machines) functions intended to perform a security related task (e.g. data confi- 
dentiality, integrity etc.). Each primitive *P is characterized by the success 6{k) 
of an adversary A. For example, a collision-resistant hash function is a function 
family {hk}ken, where hk- {0, l} 2fc — > {0, l} fc and 

6(k) = Pr[(x,x') <- A(l fc ): x / h k (x) = h k (x')] . 

In more rigorous definitions m, h k is randomly chosen from a set $ £ 
F*. Otherwise A may output a fixed collision. We write h(x) instead of hk{x). 
Sometimes, we need hash functions H = {Hkjketi of type Hk- {0, 1}* — *• {0, l} fc . 
An adversary A G F* breaks f £ l P (and write A breaks /) if A has non-negligible 
success. An instance f £i P is secure if no A e FP breaks /. An instance f £ ( , P 
is secure relative to an oracle O if no A e FP° breaks /. 

3 Time-Stamping Schemes and Their Security 

3.1 The Scheme of Haber and Stornetta 

A time-stamping scheme |S] involves three parties: a Client C, a Server S, and 
a Repository 9t; and two procedures for time-stamping a data item and for 
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verifying a time stamp (Fig. [T]). It is assumed that 93 is write-only and receives 
items from S in an authenticated manner. 

Time-stamping procedure is divided into rounds of equal duration. During each 
round, S receives requests from Clients. For simplicity, all requests aq , . . . ,x m 
are assumed to be bit-strings Xi G {0, l} fe . If the f-th round is over, S computes a 
compound hash r t G {0, l} k by using a function h: {0, l} 2fc — > {0, l} fc and a tree- 
shaped hashing scheme r t = Gh(x i, . . . , x m ). For example, if the requests of the 
t-th round are aq, aq, x 3, aq, then S may compute r t = h(aq, /i(/i(aq, aq) , 3:4)) . 
Next, S sends r t to 93 (in a secure way), where it is stored as a pair ( t,rt ). 



SerV6r 

r, 

Repository 

r. 



z 4 

"T) 

[Client] 

*iO-[ 

i/V W W V "•/ 

l Zi 

V 



Fig. 1 . The scheme of Haber and Stornetta (a simplified model) 


After that, S issues for each request x a time- certificate c = ( x , t. n, z), where 
t is current time value, n is an identifier n = n\U2 ■ ■ -nt G {0, l} 1 , and z is a 
sequence z = (z\, Z 2 , . ■ . , zf) G ({0, l} fe ) . In the scheme of Fig. [lj the time- 
certificate for aq is (aq,f, 0000, (zi, £2, £3, £4)), where z% = x 2 , z 2 = h{ £3,3:4), 
Z 3 = h(h(x 5 ,X 6 ),X 7 ), and Z 4 = h(xs,xg). 


Verification procedure is performed by C as follows. To verify (a;, t, n,z), C com- 
putes a hash value r' t by using h and a Fh( ar; n; z), which computes a sequence 
V = ( y 0 ; l/i , ■■■ , ye) G ({0, l} fc ) inductively, so that t/o := x > an d 


Vi 


h{zi,yi- 1) if Hi = 1 
h{yi-i,Zi) if ^ = 0 


(1) 


for i > 0, and outputs r[ = F h (x: n: z) := y t. Second, C sends a query t to 93 
and obtains rt as a reply. Finally, C checks whether r' t = rt- Note that n and z 
can be equal to empty string |J , in which case F h (x: n; z) = x. 

Security condition [5] states that the time-stamping scheme above is secure 
against A H s € FP that sends requests aq, . . . ,x q to S and queries to 93. As a 
result, Ahs outputs a time-certificate ( x,t,n,z ), where x G {0, l} fe , n G {0, ify, 
and z G ({0, 1 } k Y- The attack is considered successful, if x / Ga;{, . . . , x q } and 
F/j(x; n; z) = rt, where r t is assumed to be the correct response of 93 to query t. 
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3.2 Analysis of the Security Condition 

The scheme described above is insecure against the following behavior of A H s : 

— Ahs chooses x and Zo uniformly at random. 

- A H s sends x 0 = h(x,z 0 ) to S and obtains a time-certificate ( x 0 ,t,n,z ). 

- Ahs computes a faked time-certificate (x,t,0\\n,zo\\z), 

where || denotes concatenation. By definition, Fh(x\ 0||n; Zo\\z) = Fh(xo;n;z ) = 
rt . Hence, the attack is successful whenever x / =*o because xq was the only 
request made by Ahs- If h has reasonable security properties then Pr[x / *o] is 
non-negligibl^E This “attack” shows that the formal security definition does not 
follow the intuition behind time-stamping, because it overlooks the possibility 
of precomputations. As a success criterion, the condition x / 6x{, .... x q } is 
improper because the notion of already time-stamped items is not sufficiently 
precise. 

4 New Security Condition and Improved Schemes 

4.1 New Security Condition 

The new security condition is inspired by the following simplistic attack-scenario, 
where Bob, a criminal who steals inventions, co-operates with a server S : 

- Bob precomputes (not necessarily with Gh) some hash values n , . . . , r s that 
may help him to back-date documents in the future. His collaborator S sends 
the hash values to 9t, where they are stored as pairs (ti, n), . . . , (t s , r s ). 

— Alice, an inventor, creates a description Xa € (0, 1}* of her invention and 
requests a time certificate for xa = 'H(Xa), where H: (0, 1}* — > {0, l} fe is a 
(collision-resistant) hash function. 

— Some time later, the invention is disclosed to the public and Bob tries to 
steal the rights to Alice’s invention. He creates a slightly modified version 
Xb of Xa (at least the author’s name should be replaced), and tries to 
back-date it relative to Xa- Bob is successful, if he finds n and z, so that 
Fh(%B\n\ z) £ {n,...,r s }. Bob can use ( xs,t,n,z ) to claim his rights to 
the invention. 

In order to formalize such attack scenario, a two-staged adversary A = 
(Ai, A 2 ) is needed. The first stage A| precomputes a set = {rq, . . . ,r s } after 
which the second stage A 2 obtains a new document X e {0,1}* (“a document, 
unknown to mankind before”) and tries to back-date it by finding n and z, so 


If h is collision-resistant, Pr[x = *o] = Pr[x,zo *— Uk'-h(x,Zo) = z] = 8, and p x = 
Pr[®' <— Uk\ h(x. x') = x], then the collision-finding adversary (xx' , xx") ■>— A(l k ) 
(where x,x',x" <— Uk are independent random bit-strings) has non- negligible suc- 
cess. Indeed, the probability 8' that A outputs a collision for h (possibly, with x' = 
x") is 8' > Pr[a:] -p\ > (£* Pr[x] ■ p x ) 2 = 8 2 , where Pr[a:] = Pr[X ^U k :X = x\. 
Hence, the overall success of A is at least 8 2 — 2~ k . 
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that Fh (Ti.(X): n; z) £ 91. The term new document is hard to define formally. As 
we saw, the condition H(X) / &{, . . . , x q } does not guarantee that X is really 
new. We assume that X is chosen according to a distribution 29 on {0, 1}* that 
is somewhat unpredictable to A. The success of A is defined as follows: 

6(k) = Pr[{% a) ^A 1 (l k ),X^V,(n,z)^A 2 (X, a): F h (H(Xy,n;z)efR] , (2) 

where a denotes a state information sent from Ai to A2. Note that (j2J) can be 
simplified by assuming | 9T |= 1, because this reduces S(k) only polynomially. 

Necessary Conditions for D. Intuitively, the prediction of V must require super- 
polynomial time-success ratio, i.e. every A with running time T(k) and success 
S(k) = Pr[9l <— A(l fe ),a: «— 29: x £ 91] has time-success ratio = k u ^\ In 
case V is polynomially sampleable, an equivalent assumption is that 

P C (Z>) = Pr [y <— T>,x <— T>:x = y\ = k~^ l \ (3) 

where Pc (29) is the collision probability of D. Indeed, if for a poly-time A we 
have Pr[9l<— A(l fc ),a;-<— 29: :re91] = T(k) ■ k~°^\ then there is 9t o C{0,l} fc , so 
that |9to|= k°W a nd Pr[x^V: x£<R 0 \ = k~°W. Thus, 

3r£?R 0 :p = Pr[a:<— 29: x = r] = 1 9l 0 1” 1 -k~°^ = k~°^ 

and hence Pc? (29) > p 2 = k~°^\ If, in turn, Pc (29) = k~°^\ then every A with 
output distribution 29 has success 6(k) = k~°^\ 

The condition (J3J) is equivalent to the requirement that 29 has Renyi entropy 
H2(29) = — log 2 Pc (29) = a; (log k), and is in fact necessary for a time-stamping 
scheme to be secure relative to 29. Indeed, if Ai is defined to output y «— 29 and 
(U? U) & 2 (x,a) (for any x and a), then (Ai, A2) has success Pc (29). 

Chain-Resistant Hash Functions. The security definition (J2J implies that h must 
satisfy the following new security condition for hash functions: 

Definition 1. A hash function h is chain resistant (relative to a distribution 
29 fc on {0, l} fe ), if for every adversary A = (Ai, A 2 ) £ FP: 

Pr[(K,a)^A 1 (l k ),x^V k ,(n,z)^A 2 (x,a):F h (x-,n-,z)£Vi] = k-“W . (4) 

It is easy to show that if a time-stamping scheme is secure relative to 29, then 
the hash function h is chain-resistant relative to 22(29). 

4.2 Improved Verification Procedure 

We will prove later that the conventional black-box techniques are insufficient to 
imply chain-resistance from collision-resistance, and hence, also the security of 
time-stamping schemes in the sense of © cannot be proved under the collision- 
resistance condition alone. We modify the verification procedure in a way that 
prevents the adversary from finding chains for h without finding collisions as by- 
products. We restrict the set 91 C {0,1}* of identifiers (possible shapes of hash 
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chains) that are considered valid by the verification procedure and show that if 
1 91|= k ol ' l \ then the collision-resistance of h is sufficient for a time-stamping 
scheme to be secure. The modified verification procedure is defined as follows: 

New Verification Procedure. To verify a time-certificate ( x , t, n, z ) for X £ {0, 1}*, 
C checks if x = 'H(X), computes a hash value r' t using F h (x: n: z) defined by ([lj , 
sends a query t to IK to obtain r t , and checks if r' t = r t and n £ 91. 

To be usable in practical time-stamping, the condition n £ 91 must be ef- 
ficiently verifiable. One way to achieve this is to set 91 = {0, l} fc °, where ko is 
constant, which means that n £ 91 is equivalent to ||n|| = ko and is naturally 
efficiently computable. The set 91 can be viewed as a template of a hashing 
scheme that is published by the service provider before the service starts. As we 
consider service providers as possible adversaries, 91 is created by an adversary. 
The restrictions above lead us to a weaker condition with the following notion 
of success: 

Pr[{ft,%a)^A 1 {l k ),X^V,(n,z)^A 2 (X,a):F h (H(X);n-,z)e%neyi] . (5) 

4.3 Proof of Security 

We prove that the security of the modified hash-based time-stamping schemes 
follows from the collision-resistance of h and hi. 

Definition 2. Let y = (t/o, Vl>-- ■ >Vt) an d y' = (v'oj t/ii ■ ■ ■ » v'c) be two sequen- 
ces produced by Fh(x;n;z) and Fh(x'\n';z') respectively, by using (QJ). Let z = 
(zi , . . . , zf), z' = (xj, • • • , z' t ,), n = n\ . . . ni, and n! = n[ . . . n' e ,. We say that 
sequences y and y' comprise a collision, if for some indices i £ {1, . . . ,£} and 
j £ {!,..., (!}, h(a, b) = yi = yt = h(a', b'), but (a, b ) / =s'(, b'), where 




and 


Lemma 1. If x / and F h (x: n: z) = F h (x/: n: zJ), then the sequences y and 
y' computed internally by Fh(x: n; z) and Fh(x'-, n; z') comprise a collision. 

Proof. Let I be the bit-length of n. As x = y 0 / fo = x ' all( l Vi = F h (x: n; z) = 
Fh( x'\ n; z') = y' t , there exists i £ {1, . . . ,£}, such that yi = y\ and y t - 1 / y{_ 1 . 
Hence, either h(zi,yi-i) = h(z’ i ,y r i _ 1 ) or h(yi-\,Zi) = h(y' i _ 1 ,zl). In both cases, 
we have a collision. □ 

Theorem 1. If h and H are collision-resistant, then the time-stamping scheme 
is secure in the sense of m relative to every polynomially sampleable V with 
Renyi entropy H 2 (T>) = w(log k). 

Proof. Let A = (Ai,A 2 ) be an adversary with running time T(k) that breaks 
the time-stamping scheme in the sense of ((5j) with success S(k). Assuming the 
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collision-resistance of hi, we construct a collision-finding adversary A' for h with 
running time T'(k) = k°^T(k) and with success 6'(k) > — k~ u ^\ and 

hence, = k°^ ■ The adversary A': 

- calls Ai and obtains 9t = {n, . . . , r m j, 91 C {0, 1}*, and a £ {0, 1}*; 

- generates two independent random strings X, X’ <— D and calls A 2 twice to 
obtain (n, z) <— A 2 (X, a) and ( n ', z') <— A 2 (X', a); 

- simulates Fh(H(X); n; z) and Fh(H(X'); n 1 ; z'). 

If F h (H(X)-, n; z) = F h (H(X'); n'; z'), H(X) / U{X'), and n = n', then by 
Lemma [T] above, A' is able to find a collision for h. By Lemma [5] below, the 
probability that all these conditions hold is at least ^{k) ~ 2~ H ^ n ^ D '<\ 

It remains to show that 2~ H A' H( P)) = Pc(H(T>)) = k~ u< A\ Let C be a 
collision-finding adversary that on input l k generates X <— V and X’ «— V inde- 
pendently at random and outputs ( X , X’). Let Ei denote the event that X = X’ . 
Hence, Pr[Ei] = P C (D) = k~ u ^\ Let E 2 be the event that H(X) = H(X'). As H 
is collision-resistant, the success of C is Pr[E 2 \E!] = and due to Ex C E 2 , 

we have P C (W(X>)) = Pr[E 2 ] = Pr[Ei] + Pr[E 2 \Ei] = k~ u ^+k~ u ^ = k~^\ □ 

Lemma 2. The success of A' is at least _ 2 _H2 ( W 1 X ’)). (See Appendix) 

Remark. Using the improved verification procedure, it is possible to achieve the 
original security condition of Haber and Stornetta, assuming that the server S 
is honest and the set 91 is a prefix-free code with a polynomial number of words. 


5 Necessity of the Improved Verification 

In this section, we prove that the conventional proof techniques used in theo- 
retical cryptography - black-box reductions and semi black-box reductions - are 
unable to prove that collision-resistance implies chain-resistance. Hence, in some 
sense the modifications in time-stamping schemes are necessary for establishing 
their provable security. For the self-containedness of this paper, we introduce 
some basic results about oracle separation, which have been used to prove sev- 
eral ’’impossibilities” in theoretical cryptography [6-8, 13]. 

5.1 Cryptographic Reductions and Oracle Separation 

Almost all known constructions of a new primitive ^2 from another belong 
to one of the following two types: 

Definition 3. A semi black-box reduction from fPi to is a machine P £ 
FP*, so that (1) Pf £ ('if £ ); and (2) for any A 2 £ FP* there exists 

Ax £ FP*, so that A{ breaks P? implies A{ breaks / (if £ fPij. 
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Definition 4. A (fully) black-box reduction from *Pi to ^2 is a pair of ma- 
chines P,S e FP*, so that (1) pf € ^2 (V/ G tyi); and, (2) A breaks P? 

implies S A ’f breaks / Nt G *Pi,VA G F*J. 

Ti 

Note that the universal quantifiers apply over F* instead of FP. The reason is 
that uniform reductions stay valid if the quantifiers’ range is extended from FP 
to F* and this is exactly what expresses the black-box nature of / and A in these 
reductions. We will use the following folklore lemmas about oracle separation. 

Lemma 3. (A) If there is f G ^PiflFP 0 secure relative to O but no g G SJfen FP° 
is secure relative to O, then there exist no (fully) black-box reductions from 
to *# 2 - (B) If in addition, O = ir? (equality of functions) for a n G FP*, then 
there exist no semi black-box reductions from ?Pi to ^ 2 - 

Proof. (A) Suppose ( S,P ) is a black-box reduction from ?Pi to ^ 2 - According 
to the assumptions, g = P? G ^2 FI FP° and g is insecure relative to O. Hence, 
A breaks g = P? for some A G FP 0 c F*. It follows that S^ ,A breaks /, 
V2 Vi 

contradicting S^’ A G FP°. (B) Suppose P is a semi black-box reduction from *)3i 
to ^ 2 - Let / G ?Pi n FP° be a secure (relative to O) instance of ?Pi. Let O = n* 
for some 7r G FP*. According to the assumptions, g = Pf G ^2 (~1 FP° and g is 
insecure relative to O. Hence, A breaks g = Pf for some A G FP°. Therefore, 
<p 2 

taking A 2 = A OT G FP* we have that A = A° = A~ f = breaks P? . Hence, 

there exists Ai G FP*, so that A{ breaks f, which contradicts A{ G FP°. □ 
Ti 

Definition 5. A (semi/fully) black-box reduction is said to be a self reduction 
if P is a trivial machine, i.e. pf = f (for every f). 

Lemma 4. (A) If relative to O there is a secure instance of f G *P i , which is 
also an insecure instance of ^ 2 . then there exist no (fully) black-box self reduc- 
tions from $Pi to 2 - (B) If in addition, O = (equality of functions) for a 
7 r G FP*, then there exist no semi black-box self reductions from to ^2- 

The proof of Lemma 0] is completely analogous to the proof of Lemma |3] 

5.2 Non-existence of Fully Black-Box Self Reductions 

We define an oracle O, relative to which there exist a collision-resistant hash 
function H: {0, l} 2k — > {0, l} k (chosen randomly from a set # of functions) that 
is not chain-resistant. The oracle O responds to the following queries: 

— //-queries that given as input (x\ , X 2 ) G (0, l} 2fc return H{x\, x%) G {0, l} fc . 

— Ai-queries that given as input l fc return the root r k of a Merkle tree mi 
M k , the leaves of which are all fc-bit strings in lexicographic order (Fig. 01 . 

— A 2 -queries that given as input a bit string x G {0, l} k find z G ({0, l} k ) k , 
based on M k , so that F H { x; x; z ) = r k and output a pair (x, z). 
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Fig. 2. Computations performed by Ai(l k ) in case k = 3 


We assume that 0-queries are of unitary cost and hence H is not chain- 
resistant relative to O. We define 5 so that O is insufficient for finding collisions 
for H. 

Let $ be the set of all functions H, such that for all k: (1) all non-leaf vertices 
in Mj- contain different elements of {0, l} fe and (2) all sibling-pairs (including 
the leaves) are different. Hence, the argument- value pairs in M & do not comprise 
collisions and Ai- and A 2 -queries do not help in finding collisions for H. 

Lemma 5. Every collision finding adversary A° for H that makes p{k) = k°^ 
oracle calls, has success probability k~ ulyl \ 

Proof. Let S C (0, l} 2k denote the set of all pairs in the tree Mj.. There are 
exactly 2 k — 1 of such pairs. Hence, there are 2 2k — 2 fc + 1 pairs in the complement 
S = {0, l} 2fc \5. The restriction of H to S behaves like a uniformly random 
function while the restriction of H to S is injective. Hence, if A° finds a collision 
(Pi,P 2 ) for H, then one or both of the pairs pi,P 2 belong to S. 

Let K c {0, l} 2fc be the set of all pairs for which the value of H is released. 
If Pi ) P2 € S, then the probability of finding collisions does not exceed < 

2 = k~ u ^\ because the values of H\ s can only be obtained via H-queries. 

If pi e S and P 2 € S, then the probability of finding a collision does not 
exceed •< where m is the number of A 2 -queries, each of 

which releases no more than k values of H. The maximum of the last function 
is achieved if m w 2^, and hence the success is k '£k+l = k~ u ^\ □ 

Corollary 1. Fully black-box self reductions cannot prove that collision-resis- 
tance of h implies chain-resistance of h. 

5.3 Non-existence of Semi Black-Box Self Reductions 

The oracle O defined above does not yet prove the non-existence of semi-black 
box self reductions because H does not provide full access to O, i.e. O / . 

Hence, we have to ’’embed” O into H. We define a new hash function (oracle) 
O : {0, l} 2n — > {0, 1}” recursively for all n> 0, assuming that the values of it are 
already defined for smaller indices. 
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Let M n be a complete Merkle tree, the leaves of which are all n-bit strings 
in the lexicographic order. Each internal vertex v in M n is computed as a hash 
On{vL,v R ) of the child vertices v L) v R of v. Note that as we have not yet defined 
O n : {0, l} 2 " — > {0, 1}”, the tree M n is not yet defined either. We divide the 
domain {0, l} 2 ” = {( 2 / 1 , 2 / 2 ): Vi , U ‘2 G {0, 1}"}) into two non-intersecting parts: 

- The set S of all sibling pairs in M n that occur as inputs to O during the 
computation of M n . It contains leaf-sibling pairs of the form (y0. y 1), where 
y G {0, l}" -1 , second-layer pairs of the form (0(t00, t01),0(tl0, til)), where 
f G {0, l}" -2 etc. (Fig. (2) 

— The set P of all other pairs. 

Hence, to define O n , we have to define two functions: Of: S — * {0, 1}” and 
Of : P — > {0,1}”. The function Of is defined in a deterministic way and is 
injective (no collisions can be found inside S'), while Of is a random oracle 
(obviously collision-resistant!). In addition, if n = 4 k, then we embed a chain- 
finding adversary for O/,. into Of, which means that O can find chains for itself 
and is thereby not chain-resistant. 

First of all, we define (for n = 4 k) an oracle A n : {0, l} 2 ” — * {0, 1}" that 
can be used to find chains for Ok- The oracle A n allows input pairs of the form 
(0‘ 2k x0 k ~ m l m , 0 k l k x0 k ~ m l m ), where x G {0, l} k and m G {0, . . . , k}. The set D 
of all such pairs has exactly ( k + l)2 k elements. Let be the root of Mfc (which 
has been already defined). On input of such form, the oracle A n finds (based on 
Mk) z G ({0, l} fc ) fc , such that Fq(x\ x; z) = r*. We define A n as follows: 


A n {0 2k x0 k - m l rn , 0 fe l fe x0 fe_m l m ) 


l k x0 k ~ m l m x if m = 0 , 
l k x0 k ~ m l m z m if m G {1, . . . , k} . 


Obviously, A n is injective and its values never coincide with the allowed 
inputs. 

Now we are ready to define Of. We begin with the case n / =ki which is 
considerably easier, because there is no need to embed A n into Of. To define Of 
as an injection, it is sufficient to assign different n-bit strings to all 2” — 1 internal 
vertices of M n . However, care must be taken that no sibling pairs (including the 
leaf sibling pairs) coincide with other pairs, because otherwise we may have a 
contradictory definition - different values are assigned to the same input pair. 
Such contraditions can be easily avoided if, as opposed to the leaf sibling pairs, 
the elements of internal sibling pairs are in the decreasing order. 

If n = 4 k, then we have to embed A n as a function into Of. There are 
2 n_ 2 = 2 4fc-2 second layer pairs in M n and (k+ l)2 k arguments of A n (elements 
of D). As (fc + l)2 fc < 2 4fc_2 for any k > 0, there is an injection e: D —> {0, l}” -2 
and we can embed D into the set of second layer pairs of M n , so that for each 
x G (0, l} fc and m G {0, there is t = e(x,m ) G {0,1}" -2 , such that 

e>(f00,f01) = 0 2fe x0 fe_m l m and 0(ilO,ill) = 0 fe l fc z0 fe - m l m . Now we apply 
A n to the second layer pairs in e(D) and store the values into M n as third 
layer vertices. Note that if k > 1, then there are still some second layer pairs 
for which the value of O has not yet been defined. Note also that all non-leaf 
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vertices defined thus far are different and hence to conclude the definition of 0%, 
we define (in arbitrary way) the values of other vertices (not yet defined) so that 
all non-leaf vertices are different and hence Of t is injective. 

As said above, for every n we choose Of uniformly at random from the set 
of all functions P — > {0, 1}". Now we can do it because P is fixed after the 
procedure above. Like in Lemma |5j we can show in a similar fashion that O is 
collision resistant but not chain-resistant, because O^k can be used to find chains 
for Ok (for any k > 0) and therefore also a time-stamping scheme that uses O 
as a hash function (and dU for verification) is insecure. 

Corollary 2. Semi black-box self reductions cannot prove that collision-resis- 
tance of h implies chain-resistance of h. 

6 Discussion and Open Problems 

More Efficient Reductions. The reduction established in the proof of Theo- 
rem [T] does not give sufficient security guarantees for practical time-stamping 
schemes. To show this, assume that k = 160 (output size of SHA-1) and that 
there is an adversary A = (Ai,A 2 ) with running time T(fc) = 2 16 and with 
success probability 6(k) = 2~ 16 tn 1/65000. Hence, the time-success ratio is 
T(k) /6(k) = 2 32 . If the time unit denotes the time elapsed for one hash oper- 
ation and a computer performs 10,000 hash operations per second, then T(k) 
is about six seconds. For practical time-stamping schemes, an attack with such 
ratio is considered very serious. Now let us examine the consequences of The- 
orem [T| Assume that the collision-finding adversary A' is implemented very ef- 
ficiently, so that T'(k) = 2T(k). By Lemma [2j the time-success ratio of A' is 
~ { 2 (fc) XT ^H \(-d) — 2 f 2 (k) = which is close to the birthday barrier and 

says nothing essential about security - any 160-bit hash function can be broken 
with that amount (2 81 ) of computational resources. Hence, even the highest se- 
curity of h does not exclude the attacks with ratio 2 32 . The reduction gives prac- 
tical security guarantees only in case k > 400, which is much larger than used in 
the existing schemes. Therefore, it would be very desirable to find more efficient 
reductions, say the linear-preserving ones HD], in which • sg. 

Constructions of Chain- Resistant Hash Functions. We leave open the existence 
of efficient constructions of chain-resistant hash functions, possibly as atomic 
primitives. While we proved that collision-resistance does not imply chain- 
resistance, it is still unknown whether there exist more general black-box 
constructions ( g = P h ) of chain-resistant hash functions (g) based on a collision- 
resistant one (h). In case such constructions exist, it would be sufficient to just 
replace the hash functions in the existing schemes. 

Another interesting research topic is attempts at the opposite: to prove that 
there exist no general black-box constructions of chain-resistant hash-functions 
based on collision-resistant ones. It would be sufficient to find an oracle O relative 
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to which there exist collision-resistant hash functions while no function is chain- 
resistant. Inspired by the work of Simon m it may seem tempting to define an 
oracle O capable of finding chains to any computable /: {0, l} 2fe — ► {0, l} fc , the 
description of which is given to O as an argument. However, there seem to be no 
obvious ways of doing this. For example, if O is able to compute the root of the 
complete Merkle tree m[ for any (computable) hash function /, then one can 
show that such O can also be “abused” to find collisions for any hash function. 

At the same time, it seems very likely that the oracle used by Simon [T3] (to 
prove that collision-resistant hash functions are not black-box constructible from 
one-way functions) is also sufficient for showing that collision-resistant hash- 
functions cannot be constructed from the chain-resistant ones. 

Stronger Security Conditions. The chain-resistance condition is still too sim- 
plistic, considering some scenarios that are very likely to happen in practical 
implementations of time-stamping schemes. Instead of having unconditional un- 
certainty about x, it is possible that A, has some partial knowledge y = f(x) 
about x (e.g. ciphertexts or signatures). This suggests a stronger condition: 

Definition 6. A function h is universally chain-resistant if for any (proba- 
bilistic) function f and for any poly-time adversary A = (Ai,A 2 ) with success 
6 = Pr[x a) <— A 1 (f(x)),(n,z) A 2 (x, a): F h (x-,n;z) e fH] = k ~°C) 

there is a poly-time A' with success Pr[x <—'D,x , <— A'(f(x)): x 1 = x] = k~°^\ 

Loosely speaking, if x can be time-stamped based on y = f(x), then x can 
be efficiently computed based on y, and hence the time stamp is “legitimate”. 
This condition implies chain-resistance if we define /( x) = l k . 

Though the universal chain resistance condition seems natural, it is probably 
not achievable. To see this, assume that h is one-way even if one of the arguments 
is revealed to the adversary, i.e. every A' g FP has success 

8'(k) = Pr[(x, z) <— U 2 k,x' <— A' (h(x,z),z):x = x r ] = k~“^ . (6) 

This assumption is intuitively assumed to hold in the case of conventional 
hash functions. Let / be a probabilistic function such that (h(x,z),z) <— f(x), 
where z <— £4; and let A = (Ai, A 2 ) be defined as follows: ({y}, z) <— A-j (y, z), 
and (0,^) <— A 2 (x,z). Clearly, the success of A (in the sense of universal chain 
resistance) is 6 = 1, while no adversary A' can efficiently invert /. Therefore, 
no functions that are one-way in the sense of © are universally chain resistant, 
which means that this is a very strong security requirement. Even if h is de- 
fined as a random oracle, it is still insufficient for the universal chain-resistance. 
Nothing changes if the set of valid identifiers is polynomially restricted. 
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A Proof of Lemma 2 

Let Pr[9^,9T,a] = Pr[(9t,9t,d) ^ Ai(l fc ):9t = 9t, 91 = 91, 0 = 0 ] and 
Pr[Brk | 9t,9t,a] = Pr[X z)^A 2 (X, a): F h (H(X); tv, z) eft, ne9t] . 

By definition, Pr[Brk 1 94, 91, a] is the conditional success of (Ai, A 2 ), assuming 
that Ai outputs (91, 91, a). Thus, S(k) = Pr [9T,9l,<x] • Pr[Brk 1 91, 91, a], where 

the sum is computed over all possible outputs of A^l**). Let 

Pr[Brk(p,n)\%%a\ = Pr\X^-D,(n,z)^A 2 (X,a):F h (H(X)-,n-,z) = p£9i,n = n£<Jl} 

be the conditional probability of success with additional condition that the iden- 
tifier (output by A 2 ) is n and the result of the hash chain is p € 91. Now assume 
that A' has finished and hence the following computations have been performed: 
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(JK,9t,a)«-Ai(l fc ),*/ 


<— T> (n^z) <— A 2 (X, a ) p= F h (H(X ) ; n\z) 

(r^^0 , )^A 2 (X , ,a) , / 9 / = F /( (H(A: , );n / ;^ , ) . 


Let Coll denote the event that A 7 finds a collision and let Coll 7 denote the event 
that A 7 finds a collision so that ~p = // £ 91, n = n! . By Lemma [T] the event Coll 
is a superset of Coll 7 fl {H(X) / H{X')). Hence, the success 8'{k) = PrfColl 7 ] of 
A 7 satisfies 

8'{k) > Pr[Coll / n {H{X) / U{X'))\ m 1 - Pr[(-.Coll') U {H{X) = W(X 7 ))] 

> 1 - (1 - Pr[Coll / ]) - Pr[H(X) = W(X 7 )] = Pr[Coll'] - P C (X>) . 

Therefore, it remains to estimate Pr [Coll 7 ] . Let Coll \n,p) denote the product 
event Coll 7 fl (n = n 7 = n) fl (p = p' = p) . From the independence of the two runs 
of A 2 it follows that Pr[Coll '(n,p) | 91, 91, a] = Pr 2 [Brk (n,p) | 91, 91, a] and hence, 

Pr[Coll' | 91, 91, a] = ^Pr[Coll'(»,p) | 91, 91, a] = ^ Pr 2 [Brk(n,p) | 91, 91, a] 

= J>r 2 [Brk|91,91,a] • Pr 2 [n,/9|91,91,a,Brk] = Pr 2 [Brk|9t,9t,a] -^Pr 2 [n,p|9l,9l,o,Brk] 



where the first inequality holds because p Pr \ n ’ P I 91, 91, Brk,a] = 1 and 
2 

for any probability space X , we have P r M > p- • The second inequality 

follows from the observation that 91 and 91 are produced by the adversary and 
hence their size cannot exceed the running time. Therefore, 


^Pr[9f,9t,a] • Pr 2 [Brk 1 91, 91, a] 


(Pr[91,91,a] ■ Pr[Brk 1 91, 91, a]) 2 _ 8 2 (fc) 
T 2 {k) ~ T 2 (k) 



> 


T 2 (k) 


which follows from the Jensen inequality. 
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Abstract. We consider the problem of securely computing the Greater 
Than (GT) predicate and its generalization - securely determining mem- 
bership in a union of intervals. We approach these problems from the 
point of view of Q-Conditional Oblivious Transfer (Q-COT), introduced 
by Di Crescenzo, Ostrovsky and Rajagopalan [4]. Q-COT is an oblivi- 
ous transfer that occurs iff predicate Q evaluates to true on the parties’ 
inputs. We are working in the semi-honest model with computationally 
unbounded receiver. 

In this paper, we propose: (i) a stronger, simple and intuitive definition 
of COT, which we call strong COT, or Q-SCOT. (ii) A simpler and 
more efficient one-round protocol for securely computing GT and GT- 
SCOT. (iii) A simple and efficient modular construction reducing SCOT 
based on membership in a union of intervals (UI-SCOT) to GT-SCOT, 
producing an efficient one-round UI-SCOT. 


1 Introduction 

This work falls into the area of constructing efficient secure multi-party protocols 
for interesting functionalities. The more basic the functionality, the more com- 
mon is its use, and the more significant is the value of any improvement of the 
corresponding protocol. We start with presenting the problems we investigate 
and their motivation. 

The base functionality we consider - Greater Than (GT) - is one of the 
most basic and commonly used. Secure evaluation of GT is also one of the most 
famous and well-researched problems in cryptography. There exist a vast number 
of applications relying on it, such as auction systems or price negotiations. 

Another typical example would be secure distributed database mining. The 
setting is as follows: several parties, each having a private database, wish to 
determine some properties of, or perform computations on, their joint database. 
Many interesting properties and computations, such as transaction classification 
or rule mining, involve evaluating a large number of instances of GT [T2J[T3] . Be- 
cause of the large size of the databases, even a minor efficiency gain in computing 
GT results in significant performance improvements. 
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Other functionalities - memberships in a set of intervals and their conjunc- 
tions and disjunctions - are less studied, but nevertheless are very useful. Their 
immediate uses lie in appointment scheduling, flexible timestamp verification, 
expression evaluation, in the areas of computational geometry, biometrics, and 
many others. Certain kinds of set membership problems, as studied by Freedman, 
Nissim and Pinkas (7], can be represented succinctly as instances of problems 
we consider. For example, the problem of membership in a set consisting of all 
even integers on a large interval (y, z ) can be represented as a conjunction of 
two small instances of interval memberships (S' = {x\xq < 1 A x £ (y, z)}, where 
xq is the low bit of x). In such cases, using our solutions may have significant 
advantages over the general set intersection solution of [7]. 

The setting with computationally unbounded receiver (Alice) is very appeal- 
ing, both for oblivious transfer and general computations. Numerous papers 
consider unconditional security against one or more parties, in particular, the 
receiver, e.g. Practical one-round computation with unbounded 

first party (Alice) currently seems to be hard to achieve. The best known gen- 
eral approach [21] offers only polynomial efficiency and only for computing NC 1 
circuits. At the same time, if Alice is bounded, we could use very efficient Yao’s 
garbled circuit approach ([TBHTTH^nilSl]) at the cost linear with the size of the 
circuit. We solve the posed problems in the difficult setting (unbounded Alice), 
while achieving performance only slightly worse than the best known approach 
in the easier (bounded Alice) setting. 


1.1 Our Contributions and Outline of the Work 

After presenting preliminary definitions and constructions in Sect. 11.21 we start 
with a discussion of Conditional Oblivious Transfer (COT) (Sect. [5]). We wish to 
strengthen the current definition of [1] in several respects. Firstly, we observe that 
the definition of [J does not require the privacy of the sender’s private input. 
Secondly, we propose and justify the “l-out-of-2” Q-COT, where the receiver 
obtains one of two possible secret messages depending on Q, but without learning 
the value of Q. This is opposed to the “all-or-nothing” approach of [3] where the 
receiver receives either a message or nothing, which necessarily reveals the value 
of Q. Our approach significantly adds to the flexibility of COT functionalities 
and allows for more powerful compositions of COT protocols. We propose a 
definition of strong conditional oblivious transfer (SCOT) that incorporates the 
above observations and some other (minor) points. 

Then, in Sect. [3] we discuss previous work on the GT problem and present 
our main tool - an efficient protocol for computing GT-SCOT built from a 
homomorphic encryption scheme. We exploit the structure of the GT predicate 
in a novel way to arrive at a solution that is more efficient and flexible than 
the best previously known (of Fischlin [B]) for our model with unbounded Alice. 
Additionally, our construction is the first to offer transfer of c-bit secrets, with 
c « 1000 for practical applications, at no extra cost, with one invocation of the 
protocol, as opposed to the necessary c invocations of Fischlin’s protocol. This 
results in additional significant efficiency gains. 
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Then, in Sect. 0J we show how to use the bandwidth of our GT-COT solu- 
tion and present protocols for efficiently computing SCOT based on the interval 
membership (I-SCOT) and SCOT based on the membership in a union of k 
intervals (fc-UI-SCOT). Because of their modularity, these protocols can also be 
constructed based on Fischlin’s solution at the efficiency loss described in the 
previous paragraph. Because they leak the private inputs of the sender, we do 
not know of an efficient way to extend solutions of [4] to compute these func- 
tionalities. We remark on how to use UI-SCOT to compute the conjunction or 
disjunction of the memberships in unions of intervals. Finally, we compare and 
summarize resource requirements of schemes of Fischlin, Di Crescenzo et al., and 
ours in the Table in Sect. 14.21 

1.2 Definitions and Preliminaries 

We start by introducing the necessary terminology and notation, and refer the 
reader to Goldreich [S] for in-depth discussion. We are working in a setting 
with two semi-honest participants, who use randomness in their computation. 
By a two-party functionality we mean a possibly random process that maps 
two inputs to two outputs. We denote the view (i.e. its randomness, input and 
messages received) of a party P executing a protocol II with a party R on 
respective inputs x and y by VIEWp(a;,y). We note that VIEWp (ir, y) is a 
random variable over the random coins of P and R. 

We stress that although our constructions and analysis are presented for 
a fixed security and correctness parameters v and A, we have in mind their 
asymptotic notions. Therefore, for example, when talking about a view of a 
party VIEWp (x, y), we mean an ensemble {VIEWp (a:, y)} v .\ of views. 

We denote statistical closeness of ensembles of random variables X and Y 
by X = Y and their computational indistinguishability by X = Y. We say 
a function p : N i -R, is negligible if for every positive polynomial p(-) there 
exists an N, such that for all n > N,p(n ) < 1 /p(n). We say a probability is 
overwhelming if it is negligibly different from 1. 

Homomorphic Encryption. Our constructions use semantically secure pub- 
lic key probabilistic additive homomorphic encryption. Informally, a scheme is 
probabilistic (or randomized ), if its encryption function uses randomness to en- 
crypt a plaintext as one of many possible ciphertexts. It allows re-randomization 
if a random encryption of a plaintext can be computed from its ciphertext and 
the public key. In our work, we will rely on the unlinkability of encryptions 
of the same message. An encryption scheme ( G , E, D) is homomorphic , if for 
some operations ® and ® (defined on possibly different domains), it holds that 
D{E(x® y)) = D(E(x) 0 E(y)). A scheme is called additively (multiplicatively) 
homomorphic if it is homomorphic with respect to the corresponding operation 
(e.g. additive scheme allows to compute E(x + y) from E(x) and E{y)). Many 
of the commonly used schemes are homomorphic. For example, the ElGamal 
scheme is multiplicatively homomorphic, and Goldwasser-Micali m and Pail- 


1 Correctness parameter specifies the allowed probability of error in the protocols. 
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Her [18] schemes are additively homomorphic. Unfortunately, it is not known 
whether there exists a scheme that is algebraically (i.e. both additively and mul- 
tiplicatively) homomorphic. We note that an additively homomorphic scheme 
allows multiplication by a known constant, i.e. computing E{cx) from E(x) and 
c, via repeated addition. 

The Paillier Cryptosystem. Our protocols require an additional property of 
the encryption scheme: the large plaintext size, or bandwidth. The Paillier scheme 
U8] satisfies ah our requirements, and we will instantiate ah our protocols with 
it. We present it for completeness, but omit the number-theoretic justification. 

Key generation: Let N be an RSA modulus N = pq, where p, q are large 
primes. Let g be an integer of order Na modulo TV 2 , for some integer a. The 
public key pk = (N, g) and the secret key sk = A (N) = lcm((p — 1), (q - 1)), 
where A (N) is the Carmichael’s lambda function. 

Encryption: to encrypt m G compute Enc(m) = g m r N mod N 2 , where 
r Gr 2Z* n . 

Decryption: to decrypt a ciphertext c, compute m = |fe(w) mod a-=») mo< ^ 
where L{u) = takes as input an element from the set Sn = {u < N 2 \u = 1 
mod IV}. 

Re-randomization: to re-randomize a ciphertext c, multiply it by a random 
encryption of 0, i.e. compute cr N mod N 2 , for r Gr ZZ*i\i- 

The underlying security assumption is that the so-called composite residuos- 
ity class problem is intractable (called the CCRA assumption). It it potentially 
stronger than the RSA assumption, as well as the quadratic residuosity assump- 
tion, used in [B], We refer the interested reader to m for further details. 

2 Strong Conditional Oblivious Transfer 

The notion of COT was introduced by Di Crescenzo, Ostrovsky and Rajagopalan 
[4] in the context of timed-release encryption. It is a variant of Obhvious Transfer 
(OT) introduced by Rabin [19]. Intuitively, in COT, the two participants, a 
receiver R and a sender S, have private inputs x and y respectively, and share 
a public predicate Q(-, •). S has a secret s he wishes (obliviously to himself) to 
transfer to R iff Q(x, y) = 1. If Q(x, y) = 0, no information about s is transferred 
to R. R’s private input and the value of the predicate remain computationally 
hidden from S. 

2.1 Our Definitions 

We start by describing several ways of strengthening the existing definition with 
the goal of increasing modularity and widening the applicability of SCOT pro- 
tocols. Our own construction for UI-SCOT, for example, requires its building 
blocks to have the proposed features. 
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First, while sufficient for the proposed timed-release encryption scheme, the 
definition of [1] lacks the requirement of secrecy of the sender’s private input. 
We would like the new definition to include this requirement. 

Secondly, we prefer the “l-out-of-2” approach. In our proposed setting, the 
sender possesses two secrets so and si, and wishes (obliviously to himself) to send 
si if Q(x,y) = 1, and to send so otherwise. Unlike the COT “all-or-nothing” def- 
inition, this allows SCOT protocols to have the property of not revealing Q(x, y) 
to the receiver. This proposal strengthens the definition since while a SCOT 
protocol can be trivially modified to satisfy COT definitions of [3] , the opposite 
does not (efficiently) holcH. Further, note that it follows from our requirements 
that a Q-SCOT protocol can be trivially modified into a (-iQ)-SCOT protocol. 
This also does not hold for COT. We will use this important property in our 
constructions later in the paper. 

Finally, as a minor point, we only require statistical, as opposed to perfect, 
correctness and security against R, to allow for easier analysis of the protocols 
and wider applicability of the SCOT notion. 

We now present our definition. Let sender S and receiver R be the partic- 
ipants of the protocol. Let v be the security parameter and A be the correct- 
ness parameter, upperbounding error probability by 0(2 -A ). Let D f and Dg 
be the respective domains of parties’ private inputs and sender’s secrets. Let 
di = \Dj\ and dg = Dg \ . We assume that both domains are known to both 
parties. Let R have input x £ Df, and S has input (y £ Df, sq. sq £ Dg). Let 
Q : Di y, Df \ — 0 {1 } be a predicate. Consider the SCOT functionality: 

Functionality 1 

. j (si, empty string) 

fQ-SCOT{X, (y,So,Si)) = < . , 

I (so, empty string) 

There are many models in which we can consider computing this functionality. 
Each of the two parties may be malicious or semi-honest and each party may or 
may not be computationally limitec0. We wish to give one definition that refers 
to all possible models and rely on existing definitions of secure computations in 
these models. We refer the reader to Goldreich jS] for in-depth presentations of 
definitions of security in many interesting models. 

Definition 1. (Q-Strong Conditional Oblivious Transfer) 

We say that a protocol II is a Q-strong conditional oblivious transfer protocol 
with respect to a given model, if it securely implements functionality /q-scot 
m in the given model. 

We note that this general definition covers the case when Q is probabilistic. 


2 Clearly, because secure multi-party computation can be based on OT (Kilian fl3]l. 
COT implies SCOT. This solution, however, is inefficient. 

3 Of course, in some of the combinations it is not possible to have nontrivial secure 
SCOT protocols, such as when both parties are computationally unlimited. 


if Q(x,y) = i, 

otherwise 
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One of the more practical and interesting settings is the model with the semi- 
honest unlimited receiver, semi- honest poly time sender and deterministic Q. We 
discuss our constructions in this model, and thus wish to explicate the definition 
for this setting. 

Definition 2. Let receiver R, sender S, their inputs x and y, secrets si and 
so, unary parameters v and X, and predicate Q he as discussed above. We say 
that II is a strong conditional oblivious transfer protocol for predicate Q in the 
semi-honest model with computationally unlimited receiver and polytime sender 

if 

— Transfer Validity. With overwhelming probability in X: If Q(x. y) = 1, R 
obtains si, otherwise R obtains so- 

— Security against R. (R obtains essentially no information other than the 
transferred secret) There exists a simulator Sim#, such that for any x, y, s, s' 
from appropriate domains: 

if Q(x, y) then {Sim fl (a;, s)}„ = {VIEW^z, (y, s', s))}* 
if-iQ(x,y) then {Sim H (:r, s)}„ = {VIEW^ (x, (y, s, s'))},/ 

— Security against S. (S gets no efficiently computable information about x) 
There exists an efficient simulator Sims, su °h that for any x, ( y , so, si) from 
appropriate domains: 

{Sim s (y, s 0 , si)}* = {VIEW 5 (x, (y, s 0 , si))} u . 

As further justification, we wish to point out an interesting use of Q-SCOT 
protocols. When sufficiently long secrets are chosen randomly by S, upon com- 
pletion of a Q-SCOT protocol, R does not know either the value of Q, or the 
non-transferred secret. Thus this can be viewed as a convenient way to share the 
value of Q among R and S. Further, the secret that R received may serve as a 
proof to S of the value of Q. This is not possible with COT, as R is only able 
to provide such proof if Q(x, y) = 1. 


3 The GT-SCOT Protocol 

Research specifically addressing the GT problem is quite extensive. It was con- 
sidered (as a special case) in the context of general secure multi-party com- 
putation miI3™B|23J|22], w ^ ose so l ut i° n i s now well-known and celebrated. 
This general approach is impractical. However, because the circuit for comput- 
ing GT is quite small, it is the best currently known one-round solution in the 
model with the computationally bounded Alice. As people searched for efficient 
solutions to special classes of problems in different models, more efficient GT so- 
lutions implicitly appeared. Naor and Nissim m presented a general approach 
to securely computing functions with low communication overhead. While the 
application of their solution to GT is quite efficient in the message length, it 
needs at least 0 (logn + log |) 1 -out-of -0(n) oblivious transfers and the same 
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number of rounds, where e is the tolerated probability of error. Sander, Young 
and Yung [2T] showed that all functionalities in NC 1 (including GT) can be 
computed by a one-round polytime protocol. Their solution is secure against 
unbounded Alice. Unfortunately, when used with the natural shallow GT cir- 
cuit0 (which seems to be optimal for their approach), it requires at least n 4 
modular multiplications and n 4 log N communication (where n is the input size, 
and N is the GM modulus used). 

Finally, in 2001, Fischlin [5] proposed a solution that significantly reduced 
the number of modular multiplications, while also reducing the message size 
and maintaining the minimal one-round efficiency. This is the best previously 
known solution to the GT problem in the model with unbounded Alice. The 
number of modular multiplications required to complete his protocol is 8nA, 
where 2~ x is the allowed error probability. The message complexity (in bits) is 
nlog Af(A + l). Fischlin also extends this protocol (at the cost of approximately 
doubling the communication and computation costs) to satisfy our definition of 
GT-SCOT, with the exception of leaking the value of the predicate. We remark 
that this extension can be further extended to fully satisfy our definitions at the 
expense of further approximately doubling the communication and computation 
costs. 

3.1 Our Construction 

Our constructions use semantically secure additively homomorphic encryption 
schemes with large message domains. For the ease and clarity of presentation 
and to enable resource analysis, we “instantiate” our protocols with the original 
Paillier scheme. We remark that the Paillier scheme has received much attention 
in the literature recently, and several variants, including an elliptic curve version 
[8], have appeared. Using more efficient implementations may further improve 
our results. 

Let (Gen, Enc, Dec) be the instance generation, encryption and decryption 
algorithms, respectively, of such a scheme. As in Definitional let R and S be the 
receiver and the sender with inputs x and y respectively and common parameters 
v and A. Let x,y £ Di and so>si € As- Let ds = As and, without loss of 
generality, dj = \Di\ = 2 n . 

Throughout this section, we will work with numbers which we will need 
to represent as binary vectors. For x £ IN, unless specified otherwise, x, will 
denote the i th most significant bit in the n-bit binary representation of x, in- 
cluding leading zeros, if applicable. Where it is clear from the context, by x 
we may mean the vector < xi,x%, .... x n >, and by Enc(x) we mean a vec- 
tor < Enc(aq),Enc(a? 2 ), ...,Enc(x n ) >. We will also write Enc(x) instead of 
EnCpfc(x), where pk is clear from the context. 

For the clarity of presentation, we describe the setup phase outside of the 
protocol. We stress that it is run as part of As first move, and in particular, 
after the parties’ inputs x, and (y, sq. si) have been fixed. 


4 The circuit based on the formula used by Fischlin’s protocol [6]. 
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Setup Phase. R sets up the Paillier encryption scheme with group size N = pq 
by running Gen and generating secret and public keys ( sk and pk). He chooses 
the number of bits in N to be max{i/, ti s + A}. 

We will view Ds as a subset of -Zfj v, and will perform operations on elements 
of Ds modulo N. 

Observation 1 . We envision the following practical parameter choices for our 
GT protocols. First, choose N and A to satisfy the security and correctness re- 
quirements of the encryption scheme. In practice, log IV (w 1000) A(« 40.. 80), 

so we set \d$\ = log N — X > 900 bits of the bandwidth of the encryption scheme 
to be used for sending secrets. If Ds needs to be much larger than that, it may be 
more practical to split it in blocks of size |ds| and run GT-SCOT several times. 
Choosing parameters in this manner also simplifies comparison of our results to 
others, and we follow this approach in Sect. \4.2\ 

Observation 2 . There is a negligible (in X) minority of elements of Ds in the 
group of size N. 

For our protocols, we are only interested in binary comparisons, i.e. one of 
{>, <, <, >}. We can trivially reduce {>, <} to {>, <}. Furthermore, we assume 
that x f=y. This can be enforced by mapping, for instance, x i y\ -%y + 1. 
The mapping can be done entirely by S. Similarly, we assume that sq f=s\. The 
case when so = si can be reduced to the sq f=s\ case by, for example, S setting 
y = max{ Dj} and si Gr Ds \ {.so}, ensuring that x < y and so is always sent. 

We now present the GT-SCOT construction. The intuition behind each step is 
presented immediately below, in the proof of the corresponding security theorem. 

Construction 1 . (Computing Functionality GT-SCOT) 

1. R runs the setup phase, then encrypts each bit of x with the generated pk 
and sends (pk,Enc(xi), ...,Enc(x n )) to S. 

2. S computes the following, for each i = l..n: 

(a) an encryption of the difference vector d, where d^= Xi~ y^. 

(b) an encryption of the flag vector f, where fi = x. t XOR y, = {xp — yf) 2 = 

xi - 2 Xjj/j + j/j. 

(c) an encryption of vector 7 , where 70 = 0 and 7 , = 27 *_i + f. 

(d) an encryption of vector S, where Si = di + r^ji — 1), where ri Gr Zn- 

(e) a random encryption of vector p, where m = Sl ~^ S0 8i + 81 g a ° 
and sends a random permutation ir(Enc(p)) to R. 

3. R obtains n(Enc(p)), decrypts it, and determines the output as follows: if p 
contains a single v G Ds, output v, otherwise abort. 

Theorem 1 . The protocol of Construction Q] is a GT-SCOT protocol in the 
semi-honest model, assuming semantic security of the employed encryption 
scheme. 

Proof. (Sketch): We will now show that the protocol correctly computes the 
desired functionality. It is easy to see that the homomorphic properties of the 
encryption scheme allow S to perform all necessary operations. In particular, 
step [2b] is possible because y, are known to S. 
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Observe that the flag vector / is a {0, l}-vector, with the ones in positions 
where x and y differ. Furthermore, 7 is a vector with the following structure: it 
starts with zero or more zeros, then a one, then a sequence of non-ones. Moreover, 
with overwhelming probability the non-zero elements (7 j — 1) are not multiples 
of either p or q, i.e. are in 2Z* N . This is because the fraction of multiples of p or 
q in Zjs! is negligible, and p and q are chosen randomly and independently of x 
and y. 

Let indi be the (only) position where 7;,,,}, = 1. This position is where x and 
y first differ, and thus d\ n( \ l determines GT(a:, y). The transformation (7 ,d) — > 6 
of step |2d] randomizes all coordinates of 6, while setting to the value of 
dind!- Because, with overwhelming probability, (7* — 1) £ ZZ'%,, multiplying it by 
r,; ZZ N randomizes 5 perfectly in ZZn- 

With overwhelming probability, the transformation (6, So, s i) P of step 
Eel is a permutation on ZZjq that maps —1 1 -sq- 1 1 -si- Indeed, it is not 
such a permutation only when (si — So) is a multiple of p or q, the event that 
occurs with negligible probability, because p and q are are chosen randomly 
and independently of si and so- This permutation preserves the randomness 
properties of all elements of the vector, and (as is easy to verify) performs the 
mapping we are looking for. The random re-encryption step hides the information 
that may be contained in the randomness of the encryption. Finally, the random 
permutation 7 t(p) of step E] hides the index of the determining d n . 

It easily follows from Observation [2] that the probability that there is not 
exactly one element of size |ds| in the decrypted by R vector, is negligible. Thus, 
with overwhelming probability, R terminates and outputs the correct value. 

Security of R (against the semi-honest S) trivially holds because of the se- 
mantic security properties of the employed encryption scheme. 

We now prove security of S against an unlimited semi-honest R by construct- 
ing a protocol view simulator Sim^a;, s), where x is the input, and s is the output 
of the protocol. Sim fl (x, s ) has to generate a distribution statistically close to the 
view of R in a real execution - VIEWn(2;, (y, so, si)) = {x, r, Enc(7r(/i))}, where 
r is the randomness used by R to generate pk and sk (of the setup phase) and 
the random encryptions of the first message, and 7r(/i) is defined in the protocol 
construction. Sim/{(a:,s) proceeds as follows. It first generates a random string 
r' of appropriate length (to match r). It uses r' to compute the keys sk and 
pk (including N). It then computes a candidate p!: for i = t..n , pick random 
p! i £r ZZ j\r . It then replaces a random element of p! with the received s, and 
outputs {x, r' . EiiCpfc' (/T)}, where Enc^ (//) is a vector of random encryptions 
of coordinates of p! under the pk'. Because of the previously presented argu- 
ments of the randomness of all elements of 7r(/x) (other than the one that carries 
the secret) and the randomness of re-encryption, it is easy to see that Sim fl 
generates a distribution statistically close to the view of R. We note that the 
simulation is not perfect, since the transfer of the other secret is possible during 
the real execution, with negligible probability. □ 

We observe that a GT-SCOT protocol, such as presented above, immediately 
implies solution to GT, in the semi-honest model. Indeed, running GT-SCOT 
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with at least one of the secrets s* known to R (say si = 1), immediately yields 
the desired functionality. Moreover, for GT, the transformation of step [Se] is 
unnecessary (while the re-randomization of the same step is still required). 

3.2 Resource Analysis 

We evaluate the message and modular multiplication efficiency of our construc- 
tion based on the use of Paillier encryption scheme. We note that we do not 
include the relatively small computational cost of key generation, to be consis- 
tent with the compared results of [4] and [6]. Let n be the length of inputs x 
and y in binary, iV-the size of the plaintext domain of the Paillier scheme. Then 
message complexity of Construction Q] is l = 2nlog(iV 2 ) = 4nlogiV bits. 

Let w = w(y) < n be the weight (i.e. the number of ones) of the binary 
representation of y. To encrypt each bit, log TV multiplications are required. 
Observe that it is not necessary to perform expensive randomized encryption in 
the intermediate steps of S. This allows us to make do with only w multiplications 
for each of the steps [5a] EB 2 n - for step He] and (logiV + 2)n - for step[2dl and 
(| Si | + log N)n < 2n log N - for steppe] of the protocol. We note that if we do 
not perform the transformation of step [2H (when, for example, computing GT), 
we only need n log N multiplications for the last step. 

Decryption takes 2n log N multiplications. Thus, in total, the protocol re- 
quires no more than (5n+l) log iV+6« modular multiplications ((4n+l) logiV-|- 
6n for GT). We stress that transferring up to log N — A bit secrets requires the 
same resources. We observe that the encryption and re-encryption multiplica- 
tions can be precomputed once the encryption scheme is initialized. 

We now compare the efficiency of our approach to that of Fischlin [6], using 
appropriate parameters. We first note that in practice, no known attack on the 
Paillier system is better than factoring the modulus N. Clearly, factoring based 
attacks would also be effective against the GM scheme with the same modulus 
size. Thus, having already assumed CCRA (see Sect. [TJ, we also assume that 
the security of Paillier and GM schemes with the modulus of the same size are 
approximately the same. 

Compared with [5], our scheme offers a factor of A/4 improvement in message 
complexity: ((4nlog N) vs (nlogiV(A + 1)) bits). We pay higher cost in the 
number of modular multiplications: ((4n+l) log 7V + 6n) vs (6nA). Additionally, 
our multiplications are four times slower, since we are working with modulus 
length twice that of the Goldwasser-Micali encryption scheme employed in [6]. 
These comparisons are summarized in the Table in Sect. 14.21 


4 SCOT for Unions of Intervals 

In this section we present new efficient protocols for I-SCOT (SCOT based on 
the membership in an interval) and UI-SCOT (SCOT based on the membership 
in a union of intervals), both of which are generalizations of GT-SCOT. We build 
these protocols on our GT-SCOT solution. While other GT-SCOT approaches 
(such as based on Fischlin’s protocol) are also suitable for these constructions, 
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our solution is simpler and produces more efficient protocols in terms of both 
multiplication and communication complexity. In our constructions, we denote 
the instance of the Q-SGOT functionality with the secrets soi^i on parties’ 
inputs x,y by Q-SCOT (si|s o ?Q0u2/))- 

In Sect. 14.11 we show how to reduce UI-SCOT to I-SCOT and I-SCOT to 
GT-SCOT. In our model, secure reductions provide us with secure protocols 
when the underlying oracles are replaced by their secure implementations (see 
Goldreich [9] for the composition theorem.) Furthermore, in our model the ora- 
cles’ implementations may be run in parallel, which, with our implementations, 
provides secure one-round protocols for I-SCOT to UI-SCOT. 

4.1 The UI-SCOT Protocol 

Without loss of generality, we assume that the domain of secrets D s is an ad- 
ditive groupH Z^ds- AH additions of secrets will be done in Ds, unless specified 
otherwise. In the I-SCOT setting, S's input X\ , x 2 G D r represents an interval 
I, and si (resp. so) are to be obliviously transferred if x G I (resp. x fcl), for 
R’s input x G Dj. The following diagram illustrates the idea of the reduction of 
I-SCOT to GT-SCOT: 

_ai_ _ a 2 

So Si So 

_ XI _ }x 2 

h b 2 

Interval I splits Dj in three parts, and S wishes to transfer si “on the central 
part” (I) and so “on the side parts” ( Dj\I ). The idea is to represent these secrets 
as sums of independently random (i.e. random if taken separately) elements 
(ai, a 2 , bi, b 2 G Dg) which are to be transferred using GT-SCOT. 

Construction 2. (Reducing I-SCOT to GT-SCOT) 

1. S randomly chooses a± G Ds and sets bi,a 2 ,b 2 G Ds to satisfy so = ai+£>i = 
02 + b 2 and Si = 02 + b\ 

2. -Reduction: R and S (in parallel) invoke oracles for GT-SCOT(a\\a 2 lx < 
si) and GT-S COT(b\ \b 2 Ix < x 2 ). 

3. R obtains a',b' G Ds from GT-SCOT oracle executions and outputs a' + b' . 


Theorem 2. The protocol of Construction [H securely reduces functionality 
I-SCOT to GT-SCOT in the semi-honest model. 

Proof, (sketch): The transfer validity property of this reduction trivially holds. 
Since S does not receive any messages from R or oracle executions, the reduction 
is secure against semi-honest S. We show how to construct Sim#, simulating the 


5 We stress that we use GT-SCOT as black box, and, in particular, addition in Ds is 
unrelated to the corresponding operation in the GT-SCOT implementation. 
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following ensemble (view of R ): VIEW r ( a;, (xi,X 2 - sq, si)) = [x. r \ , r?}, where 
r\, r 2 are the sent (via the GT-SCOT oracles) a*, bj. Let s be the transferred se- 
cret. Then Sim fl (ir, s) = {x, r[ . r ', 2 } , where r' are independently random elements 
of Ds that sum up to s. Because, by construction, n,r 2 are also independently 
random with the same sum, Sim^ perfectly simulates view of R. □ 

We now wish to reduce UI-SCOT of polynomially many intervals to I-SCOT. 
Here, S’s input represents a set of disjoint intervals {/j = (a^i , ^12 € Dj)}, 
and the secrets so,si € Ds- S wishes to transfer si if x G [jh, and transfer 
so otherwise. Let k be the number of intervals in the set (to avoid leaking k 
to R, S can pad it to a known upper bound by adding empty intervals). We 
represent (J /,; as the intersection of one “regular” and k — 1 “cutout” intervals 
as illustrated on the following diagram. 

SlO Sn Sip 

521 520 S21 

5fcl ! S k Q S k j 

5p 5l 5p 5l 5j 5:Q: Si £p 


The bottom line represents the input set of intervals on the domain, and all 
other lines represent the constructed (by S ) intervals that together correspond 
to this set. The Sj are the secrets to be transferred by the UI-SCOT construc- 
tion, and the sy are the intermediate secrets to be created by UI-SCOT and 
transferred by the existing I-SCOT protocol. Because the input intervals are 
disjoint, the cut out (thin, on the diagram) parts of the constructed intervals do 
not intersect, and thus any x either belongs to all or to all but one constructed 
intervals. 

To reduce UI-SCOT to I-SCOT, we need to choose sy G D s based on the 
given Si. Because of the above observation we only need to satisfy the following: 
si = an d s o = Ei/g s *i) + 5jq,Vj = l..k Observe that the second 

condition is equivalent to requiring Si — So = Syi — s.yo, Vj = l..k. 

Construction 3. (Reducing UI-SCOT to I-SCOT) 

1. S chooses sn, ..., S(fc_i)i Ds and sets Ski = si — an d s io = 

syi — (si — so),i = 1 -k. 

2. -Reduction: S and R (in parallel) invoke oracles for I-SCOT(sn\sioIx G /,), 
for each i= 1 ..k. 

3. R obtains 01, ...,ak G Ds from k oracle executions and outputs J2i a i- 

Theorem 3. The protocol of Construction^ securely reduces functionality UI- 
SCOT to I-SCOT in the semi-honest model. 

Proof. (Sketch): The transfer validity property of this reduction trivially holds. 
Since S does not receive any messages from R or oracle executions, the reduction 
is secure against semi-honest S. We show how to construct Sirri/j simulating the 
view of R VIEWft(:r, y) = {x,r\, ...,rk}, where ri,...,rj, are the oracle sent 
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elements of Ds defined by step Q] of the construction. Let s be the transferred 
secret. Then Sim fl (a;, s) = {x. r\ ..... r' k }, where r[ 6jj Ds with the restriction 
s = Ei r i m Sim R perfectly simulates view of R because both ensembles are (k— 1)- 
wise independent random numbers that sum up to the same value s. □ 

The (A* I/i))-COT Protocol. We now build A, Qi{ x ii y*))-COT (in 

the sense of |3]) using oracles for corresponding Qj-SCOT. R now has input 
xi , ..., x n , and S has yi, ..., y n . S wishes to send a secret s to R iff A i(Qi( x iiVi)) 

I . The idea is to introduce “specialness” of s like we did for GT-SCOT, by, 
for example, extending the domain of secrets Ds to group D' s = TZ^, , where 
d' s = | | \Ds\, Then S represents s € Ds as a sum of random secrets 

Si Gr D' s , and runs Q , - S C O T ( s , : | r ? Q , (xi.yi)), where r, Gr D’ s . Indeed, if the 
conjunction holds, then only the sf s will be transferred, and they will sum up 
to s £ Ds . If any (or any number of) predicates do not hold, one (or more) Ti 
will be transferred, which will randomize (in D' s ) the sum obtained by R. 

Construction 4. (Reducing ( f\iQi( x i,Vi))-COT to Qi-SCOT) 

1. S chooses rq, ..., r n , Si , ..., s n _i Gr D' s and sets (inD' s ) s n = s— Sj=i.. n _i s »- 

2. R and S in parallel invoke oracles for Qi-SCOT(si\ri!Qi(xi , yi)), Vi = l..n. 

3. R obtains a\,...,a n G D' s from the Qi-SCOT oracle executions and sets 
v = a i ■ R outputs v, ifvG Ds, and outputs T otherwise. 

Theorem 4. The protocol of Construction 2] securely reduces functionality 
(KQi(xi, yi ))-COT to Qi-SCOT in the semi-honest model. 

Proof: The simple proof is very similar to the previous ones and is omitted. □ 

Corollary 1. There exists (via construction [^] and DeMorgan laws) efficient 
one-round protocols for computing conjunction and disjunction of memberships 
in sets of intervals, secure against computationally unlimited R. 

4.2 Resource Analysis 

We continue and expand the resource analysis of Sect. 13.21 Recall that A and v 
are the correctness and security parameters. As discussed in Observation [TJ we 
choose v = log A and A as in [6]. This determines the secrets domain Ds to be 
of size 2 V ~ X . As noted in Sect. 13.21 we do not include the cost of key generation 
in any of the compared solutions. 

It is easy to see that Construction |3] makes 2k calls to the underlying A-bit 
GT-COT oracle. Thus, when using our implementation of GT-SCOT, UI-SCOT 
requires sending 8 kn log N bits and performing about 40fcn log N multiplications 
in group of size N. Using A-bit GT-SCOT oracle implementation based on Fis- 
chlin’s GT results in almost full factor of 2k blowup in communication since 
server sends most of the traffic. The 2k factor blowup in the computation also 
seems necessary when using this scheme. 

The following table summarizes the cost of comparable modular multiplica- 
tions and communication of our protocol in relation to others. 
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Protocol 

GT predicate 

c-bit GT-SCOT, c<v-\ 

fc-UI-SCOT 

mod. mult. 

comm. 

mod. mult. 

comm. 

mod. mult. 

comm. 

of [5] 

8nX 

An log N 

32ncA 

4ncA log N 

64fcnA 2 

8knX 2 log N 

of H 

8 n 

4 n log N 

N/A 

N/A 

N/A 

N/A 

our work 

16n log N 

4 n log N 

20n log N 

4n log N 

40fcn log N 

8fcnlogiV 


We see no obvious way to transform the schemes of @] to GT-SCOT, and 
thus do not include the corresponding resource calculations. 

5 Conclusions and Future Work 

We presented simple, intuitive and stronger definitions for Q-SCOT. We pre- 
sented a flexible and efficient scheme for securely computing the GT predicate 
and GT-SCOT, in the semi-honest setting with unbounded receiver. We then 
showed simple modular reductions from UI-SCOT to GT-SCOT. In addition to 
the presented results, we noticed that natural efficient variants of our protocols 
are resilient to several natural attacks by malicious receivers. Devising versions 
of our protocols secure in the malicious model is an interesting aspect of further 
consideration. 
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Abstract. In the bare public-key model, introduced by Canetti el al. 
[STOC 2000], it is only assumed that each verifier deposits during a set- 
up phase a public key in a file accessible by all users at all times. As 
pointed out by Micali and Reyzin [Crypto 2001], the notion of soundness 
in this model is more subtle and complex than in the classical model. In- 
deed Micali and Reyzin have introduced four different notions which are 
called (from weaker to stronger): one-time, sequential, concurrent and 
resettable soundness. In this paper we introduce the counter public-key 
model (the cPK model for short), an augmentation of the bare public-key 
model in which each verifier is equipped with a counter and, like in the 
original bare public-key model, the key of the verifier can be used for 
any polynomial number of interactions with provers. In the cPK model, 
we give a three-round concurrently-sound resettable zero-knowledge argu- 
ment of membership for NP. Previously similar results were obtained by 
Micali and Reyzin [EuroCrypt 2001] and then improved by Zhao el al. 
[EuroCrypt 2003] in models in which, roughly speaking, each verifier is 
still equipped with a counter, but the key of the verifier could only be 
used for a fixed number of interactions. 


1 Introduction 

The notion of Zero Knowledge, put forth by Goldwasser, Micali and Rackoff [1] , 
has proved to be a fundamental concept in the area of complexity-based cryptog- 
raphy. The original notions of security with respect to malicious provers (formal- 
ized by the soundness requirement) and the security with respect to malicious 
verifiers (captured by the zero-knowledge requirement) only considered a prover 
and a verifier acting in isolation. Recently, the case in which provers and ver- 
ifiers are part of a large system (and thus prover-verifier interactions may be 
interleaved) has been considered and stronger notions of soundness and zero 
knowledge have been proposed. In a sequence of papers the notions of concur- 
rent zero knowledge [2] and resettable zero knowledge [5] were introduced and 
protocols in the standard model were provided [H|5j|6j[3] . 

P.J. Lee (Ed.): ASIACRYPT 2004, LNCS 
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An important measure of an efficiency of a system is the number of rounds 
needed. Lower bounds for the number of rounds for concurrent and resettable 
zero knowledge have shown that these strong notions of security cannot be imple- 
mented, in the standard model, using a constant number of rounds if black-box 
zero knowledge is sought [ 7 ]- Canetti et al. ( 3 ] were thus motivated to introduce 
the bare public-key model (the BPK model for short) in which, during a set-up 
stage, each verifier stores in a public file his public key to be used in all sub- 
sequent interactions and keeps secret the associated private key. In this model 
constant-round concurrent and resettable zero-knowledge arguments for all MV 
were shown to exist in [ 3 ]. 

Other models have been proposed in order to achieve similar results by focus- 
ing on black-box concurrent zero knowledge, in particular the results of [2[8l|9] 
in the timing model, those of mm in the common reference string model, 
those of m in the preprocessing model, and those of [T3] in some partially 
synchronous model. 

Among the different proposed models, the BPK model has the following ad- 
vantages: 1) it is not based on any trusted third party; 2) no timing assumption 
is made; 3) the set-up stage is non-interactively performed only by the veri- 
fiers. Consequently, the public-key model is, from among the currently proposed 
models, the one that makes the least set-up assumptions and, in particular, it is 
weaker than the widely accepted Public Key Infrastructure model. 

Subsequently to the introduction of the BPK model, Micali and Reyzin m 
noticed that, unlike in the standard model for interactive zero knowledge, dis- 
tinct notions of soundness arise depending on whether the verifier’s public key 
is used for once (one-time soundness), for polynomially many sequential argu- 
ments (sequential soundness), for polynomially many concurrently interleaved 
arguments (concurrent soundness), or whether the prover is allowed to reset 
the verifier to a given state during the interaction (resettable soundness). How- 
ever, they showed that resettably sound zero knowledge cannot be achieved in 
the black-box model for non-trivial languages. Consequently, for black-box zero 
knowledge, the strongest possible notion is that of a concurrently sound reset- 
table zero-knowledge argument. In na, Micali and Reyzin showed that in the 
BPK model, concurrent soundness cannot be achieved in less than four rounds. 
Moreover they showed that the argument system of Canetti et al. presented 
in [ 3 ] is only sequentially sound and the same holds for the four-round reset- 
table zero-knowledge argument presented in [13]. Recently, the existence of a 
constant-round concurrently-sound resettable zero-knowledge argument in the 
BPK model has been proved by m where a 4-round concurrently-sound reset- 
table zero-knowledge argument in the BPK model has been given for all MV 
languages. 

Prior to the work of [T3], augmented variations of the BPK model had been 
presented in which constant-round concurrently-sound resettable zero knowledge 
could be achieved. These proposals are interesting, even in light of the result of 
m, since they achieve three-round concurrently-sound resettable zero knowl- 
edge which is remarkable as no non-trivial (black-box) zero knowledge can be 
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achieved in less than three rounds in any variation of the BPK model [HJ[T6] . In 
particular, three-round concurrently sound resettable zero-knowledge arguments 
for all MV are possible in the upper-bounded, public-key (UPK, for short) model 
(see [IT]) and in the weak public-key (WPK, for short) model (see HU). In the 
UPK model, each public key can be used for a fixed number of arguments to be 
determined during set-up. The verifier is equipped with a counter to keep track 
of the number of arguments he has been involved in. In the WPK model, instead, 
there is a fixed upper bound on the number of times the verifier can be involved 
in sessions regarding the same statement. Thus, also in this model, the verifier 
must have a counter (actually, one for each possible statement). 

Our Contribution. In this paper we introduce the counter public-key (cPK for 
short) model, that is a model weaker than the WPK (and thus of the UPK) model 
and only slightly stronger than the BPK model. The cPK model, like the UPK of 
Micali and Reyzin and the WPK of Zhao et al., is an extension of the BPK model in 
which the verifier is equipped with a counter that, roughly speaking, keeps track 
of the number of sessions that she has been involved with. However, unlike the 
UPK model and the WPK model, each public key of the verifier can be used any 
polynomial number of times exactly like in the original BPK model. Therefore, 
our proposed model, although slightly stronger than the original BPK model, can 
be considered much weaker than the UPK model and the WPK model. Indeed, in 
the cPK model the verifier has no bound on the number of proofs he can engage 
with the provers while in both UPK and WPK models once the bound is reached, 
soundness is not guaranteed to hold. 

We first present a three-round concurrently sound resettable zero-knowledge 
argument of membership for MV in the cPK model. This construction improves 
the previous works of [T71HU that achieved the same result but in stronger mod- 
els. We notice that, in the BPK model, concurrent soundness requires 4 rounds. 
Our protocol is based on the existence of sub-exponentially hard primitives, as 
in all previous works for obtaining a const ant-round resettable zero-knowledge 
argument in any public-key model. 

Our second construction is a three-round concurrently sound concurrent zero- 
knowledge argument of knowledge for all MV relations in the cPK model under 
standard intractability assumptions. We notice that, in the black-box model, 
resettable zero-knowledge arguments of knowledge exist only for trivial languages 
and thus concurrent zero knowledge is the strongest notion of zero knowledge 
that can be achieved when arguments of knowledge are sought. 

2 The cPK Model 

The cPK model assumes that: 

1. there exists a public file F that is a collection of records, each containing a 
public key; 

2. an (honest) prover is an interactive deterministic polynomial-time algorithm 
that takes as input a security parameter 1”, F, an n-bit string x, such that 
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x £ L and L is an AT ^-language, an auxiliary input y, a reference to an 
entry of F and a random tape; 

3. an (honest) verifier V is an interactive deterministic polynomial-time algo- 
rithm that works in the following two stages: 1) in a first stage on input a 
security parameter 1" and a random tape, V generates a key pair (pk, sk) 
and stores pk in one entry of the file F; 2) in the second stage, V takes 
as input the private key sk, a counter value c, a statement “ x £ L" and a 
random string, then V performs an interactive protocol with a prover , and 
outputs “accept” or “reject”; 

4. interactions between prover and verifier start after all verifiers have com- 
pleted their first stage. 

Definition 1. Given an AfV -language L and its corresponding relation Rl, we 
say that a pair (P, V) is complete for L, if for all n-bit strings x £ L and any 
witness y such that (x,y) £ Rl, the probability that V interacting with P on 
input y, outputs “reject”is negligible in n. 

Malicious Provers in the cPK Model. We will give argument systems that are 
sound with respect to s-concurrent malicious provers, for any positive polyno- 
mial s. An s-concurrent malicious prover P* for the complete pair (P* , V) is a 
probabilistic polynomial-time algorithm that takes as input V’s public key pk, 
and, if P* is concurrently running i sessions, for 0 < i < s(n), P * can pick a 
new statement x l+ i and a value c l+ \ of the counter and start a new session with 
V on input x i+ \ and c i+ \. The only restriction is that, for each value c of the 
counter, P* can only start one session with value c. Also, we allow the malicious 
prover to schedule his messages in the concurrent sessions in any way he wants 
and, for each message of P*, V’s reply is immediately received. 

We stress here that our definition of malicious prover is the same used by L. 
Reyzin (see m) for the UPK model. Instead, in [18], the value of the counter 
is assumed to be private to the verifier and the malicious prover has no way of 
manipulating it. Moreover, we stress that in the cPK model there is no bound on 
the number of sessions in which the verifier can be involved, thus the model is 
weaker than the WPK and UPK models and very close to the standard BPK model. 

Given an s-concurrent malicious prover P* and an honest verifier V, a con- 
current attack is performed in the following way: 1) the first stage of V is run on 
input 1" and a random string so that a pair (pk, sk) is obtained; 2) P * is run on 
input 1" and pk; 3) whenever P* starts a new protocol choosing a statement, V 
is run on inputs the new statement, a new random string and sk. 

Definition 2. Given a complete pair ( P , V) for an AfV -language L in the cPK 
model, then (P, V) is a concurrently sound interactive argument system in the 
cPK model for language L if, for all positive polynomial s, for all s-concurrent 
malicious prover P* , for any false statement “x £ L” the probability that in 
an execution of a concurrent attack V outputs “accept” for such a statement is 
negligible in n. 
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The strongest notion of zero-knowledge, referred to as resettable zero knowl- 
edge, gives to a verifier the ability to reset the prover to a previous state. This 
is significantly different from a scenario of multiple interactions between prover 
and verifier since after a reset, the prover uses the same random bits. We now 
give the formal definition of a black-box resettable zero-knowledge argument 
system with concurrent soundness for MV in the counter public-key model. 
Definition 3. An interactive argument system ( P , V) in the cPK model is black- 
box resettable zero-knowledge if for any polynomial f (•), and for any probabilistic 
adversary V* running in time t(-), there exists a probabilistic polynomial-time 
algorithm S such that for any polynomial s(-) , for any xi, ■ ■ ■ , £ s ( n ) £ L of length 
n, the following two distributions are indistinguishable: 

1. the output of V* consisting of a public file F with s(n) entries and the tran- 
script of a polynomial number of (even concurrent) interactions with each 
P(xi,yi,r g ,F,i ) where yi is a witness for “xi £ L”, \xi\ = n, r g is a random 
tape and i specifies an entry of the public file, for 1 <i,l,g< s(n); 

2. the output of S that has black-box access to V* on input xi,..., x s ( n ). 

Moreover we define such an adversarial verifier V* as an (s, t) -resetting ma- 
licious verifier. 

3 Cryptographic Tools 

We review the cryptographic tools that we will use in our constructions. We 
start from the notions of an 77 -secure digital signature scheme and of a 7 -secure 
commitment scheme. 

Definition 4. An 77 -secure digital signature scheme SS is a triple of algorithms 
SS = (G, Sig, Ver) such that 

1. Correctness: for all messages m £ {0, l} fc , 

Pr[(pk, sk) <- G(l fe ); m <- Sig(m, sk) : Ver (m, m, pk) = 1] = 1. 

2. Unforgeability: for all algorithms A running in time o( 2 k ) it holds that 
Pr[(pk, sk) f— G(l fc ); (m,m)<—A°^\pk):m / ®uery and Ver (m, rh, pk) = f] 

is negligible in k where O(sk) is a signature oracle that on input a message 
returns as output a signature of the message and Query is the set of signature 
requests submitted by A to O. 

We assume that signatures of fc-bit messages produced by using keys with 
security parameter k have length k. This is not generally true as for each signa- 
ture scheme we have a constant a such that signatures of fc-bit messages have 
length k a but this has the advantage of not overburdening the notation. It is 
understood that all our proofs continue to hold if this assumption is removed. 

Standard secure signature schemes exist under the assumption of the exis- 
tence of one-way functions Qjjj]. In our case we need the existence of functions 
that are one-way with respect to subexponential-time adversaries. 
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Definition 5. An 7-secure bit commitment scheme is a pair of algorithms (Com, 
Dec) such that 

1. Correctness: for all h G {0, 1} and for all k, 

Pr[(com, dec) <— Com(6, l fe ) : Dec(com, dec, b) = 1] = 1; 

2. Perfect Binding: for all k, the set of strings com of length k for which there 
exist strings de Co, dec 1 such that Dec(com, deco,0) = 1 and Dec(com, deci, 1) 
= 1 is empty; 

3. Computationally Hiding: the ensembles of random variables 

{[(com, dec) ■*— Com(0, l k ) : com]} fe>0 and {[(com, dec)<-Com(l, l fc ) : com]} fc>0 

are indistinguishable with respect to algorithms running in time o(2 fc ); 
f. Extractability: there exists an extractor algorithm E running in time 2 fe7 
such that, for all commitments com computed by a probabilistic polynomial- 
time committer adversary A, if A succeeds in decommitting com as b with 
non-negligible probability, then E(com) = b with overwhelming probability. 

The above definitions can be easily extended to the case in which we wish to 
commit to a string (instead of committing to a bit). Such commitment scheme 
exists, for instance under the assumption that there exist permutations that are 
one-way with respect to polynomial-time adversaries but such that they can be 
inverted in subexponential time. In [20], these type of commitment schemes are 
used in order to achieve straight-line extractability in superpolynomial time. 
Finally, we review the notion of a ZAP [21]. 

Definition 6. A triple of polynomial-time algorithms ( ZG , ZP, ZV ) is a ZAP 
for the NP-language L with polynomial-time relation Rl iff: 

1. Completeness: given a witness y for “x G L” and z = ZG(l k ) then 
ZV(x,z,ZP(x,y,z)) = 1 with probability 1. 

2. Soundness: for all x / &, with overwhelming probability over z = ZG(l k ), 
there exists no z' such that ZV(x,z,z') = 1. 

3. Witness-Indistinguishability: letyi,y 2 such that (x, yi) G Rl and (x,yf) 
G Rl- Then Vz, the distributions on ZP(x,y\,z) and on ZP(x, t/ 2 , z) are 
computationally indistinguishable. 

In [21] a ZAP is presented under the assumption that non-interactive zero- 
knowledge proofs exist, thus the existence of ZAPs is implied by the existence 
of one-way trapdoor permutations. 

Since we will need ZAPs to be secure with respect to subexponentially strong 
adversaries, we need subexponentially strong versions of these assumptions. 

4 Three-Round Arguments in the cPK Model 

In the cPK model we show that there exist three-round arguments of member- 
ship for all MV languages that are concurrently sound and black-box resettable 
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zero knowledge. We stress that a concurrently sound resettable zero-knowledge 
argument in the BPK model requires at least four rounds (see [TJ) while the pre- 
viously presented three-round protocols require stronger models than the cPK 
model (see [T71ITg] h 

Our construction assumes the existence of 77-secure signature schemes, 7- 
secure commitment schemes, pseudo-random family of functions (which can be 
constructed assuming the existence of one-way functions) and the existence of 
ZAPs secure with respect to subexponential-time adversaries. We use subex- 
ponentially strong cryptographic primitives since we crucially use complexity 
leveraging for our result. 

We then show how to obtain three-round arguments of knowledge for all 
polynomial-time relations that are concurrently sound and black-box concurrent 
zero-knowledge under standard complexity assumptions. We stress that black- 
box resettable zero-knowledge arguments of knowledge are not possible [221 IT3] . 
that concurrent soundness needs four rounds in the BPK model, and that three 
rounds is optimal for zero-knowledge in any public-key model. 

4.1 Three-Round RZK Argument of Membership in the cPK Model 

In this section we present our construction for the three-round argument of 
membership for all MV in the cPK that is concurrently sound and resettable 
zero-knowledge. Throughout the section, L will be a fixed MV language. 

Our proof system will follow the FLS paradigm for zero knowledge [23] and 
we next define the auxiliary language A = A(L ) that we are going to use. 

Definition 7 . The 8-tuple r = (x, c, Si, 0 , 2 , 61, 62, k, pk) belongs to the language 
A if 

— x £ L or 

— there exist 01, 02 , ai, 012 , bi,b 2 , 0 i,(h such that 

1. pk is a public key in the output space of G(l fe ); 

2 . <Z1 / S2,- 

3. (di,ai) = Com(ai, l k ) and (02,0:2) = Com(a2, l fe ); 

4 ■ (6~i,/3i) = Com(6i, l k ) and (6^, /3 2 ) = Com(6 2 , l fc ); 

5. Ver(ai o c, 61, pk) = 1 and Ver(o2 ° c, 62, pk) = 1. 

Informally speaking, r = ( x , c, di, 02, 61, 62, k, pk) belongs to A if x belongs to 
L or if, for i = 1, 2, 6j is the commitment of a valid signature 6,; (with respect to 
pk) of the concatenation of message a, committed to by a, concatenated with c. 

Assumptions. In our construction we assume the existence of the following cryp- 
tographic tools. 

1. an ^-secure digital signature scheme SS = (G, Sig, Ver); 

2. a 7-secure commitment scheme (Com, Dec); 

3. a pseudo-random family of functions T\ 

4. a ZAP ( ZG , ZV. ZP) for the language A. 
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High-Level Overview. Let k be the security parameter. The public entry of a 
verifier contains a public key pk for a secure signature scheme and the first 
message z of ZAP for A. The actual proof that x G L consists of a first round 
where the prover sends a random message m to the verifier. The verifier replies 
with the current value c (in unary) of the counter and a signature mofmo 
c. The prover first verifies that m is a valid signature and then constructs 4 
commitments di, 02, 61, &2 of 0 fc . Finally the prover computes the second message 
of the ZAP in which he proves that x £ L or that b\ and b 2 are the commitments 
of valid signatures b\ , 62 of messages a-[ o c and u.2 0 c such that «i / «2 and a\ 
and a 2 are the messages committed in di and 02- 

Let us now informally argue the properties of our construction. For the con- 
current soundness we observe that even if the prover opens polynomially many 
concurrent sessions with the verifier, he will receive signatures of messages rel- 
ative to different values of the counter. In particular, the prover will never see 
the signature of two messages with the same value of the counter as suffix. We 
will use a 7-secure commitment scheme along with a ZAP in order to show that 
a prover that proves false statements can be used by a superpolynomial-time 
algorithm in order to break a subexponentially strong assumption. Such a tele- 
scopic use of the hardness of different cryptographic assumptions is referred to as 
complexity leveraging and its power is gaining interest. The use of an extractable 
commitment along with a ZAP is also discussed and used in [ 2 U] . 

For the resettable zero knowledge property, the simulator while interacting 
with the verifier V* will try, by rewinding V* , to get signatures for two messages 
with the same value of the counter as suffix. More precisely, to simulate the proof 
that a : £ L, the simulator will first ask for the signature of message m o c (where 
c is the current value of the counter), then he starts a look-ahead (by rewinding 
V *) in order to obtain the signature of a new message m'oc. Once the signature 
is obtained, the look-ahead ends and the simulator goes back to the previous 
original execution since it is now able to successfully run the third round. 

The crucial observation to show that the simulation ends in expected polyno- 
mial time is that the values of the counters cannot be greater than the running 
time of the adversarial verifier (since V* sends the value of the counter in unary) . 
More precisely, each look-ahead starts after the first signature corresponding to 
a given counter value and to a given public key has been received by S. Since the 
number of public keys is polynomially bounded (the size of the public file does not 
change after the preprocessing stage) and the running-time of an ( s , ^-resetting 
verifier is bounded by the polynomial t, we have that the number of look-aheads 
is polynomial. Moreover, each look-ahead starts because a given counter value 
has been sent by V * on input a given transcript. Therefore, the expected number 
of rewinds that will be needed in order to obtain again the same counter (in the 
look-ahead the corresponding signature is asked for a different message) is the 
inverse of the probability that V* plays such a value. Finally, by observing that 
the simulation between two rewinds can be run by S in polynomial time, we 
have that the simulator runs in expected polynomial-time. 
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Formal Description. Let k be the security parameter. The verifier runs the key 
generator G for the rj- secure signature scheme on input l k obtaining the pair 
(pk, sk). Moreover, the verifier rims ZG on input l k and obtains z that will be 
used as the first round of the ZAP for the language A. The entry of the verifier 
in the public file consists of the pair (pk, z). The private key sk associated with 
pk is kept secret by the verifier. Moreover, the verifier initializes her counter c 
by setting c = 0. The protocol is found in Figure [U 


Common input: security parameter k, public file F {(pk, z)} and instance x. 
P’s private input: a witness y for x €. L. 

V’s private input: private key sk and a counter c. 

P-round-1: 

1. randomly pick seed s; 

2. compute w = P(s, x o y o pk) and use w as randomness; 

3. randomly pick m <— {0, l} fc and sends it to V; 

V-round-2: 

1. increment c; 

2. compute m c = Sig(m o c, sk); 

3. send (l c , rh c ) to P; 

P-round-3: 

1. verify that Ver (to o c, rh c , pk) = 1; 

2. randomly pick seed s'; 

3. compute w' = T(s' , x o y a pk o rh c o c) and use w' as randomness; 

4. use a y-secure commitment function Com to compute commitments 
5i, a,2, bi, 62 where dj = Com(0 ,e , l fcl ) and bj = Com(0 fc , l fcl ) for j == 1, 2; 

5. compute Z = ZP((x, c, 01, S2, 61, 62, k , pk), y , «); 

6. send a 1,02,61,62 and Z to V\ 

V-decision: verify that the ZAP is valid by running ZV on input instance 
r = (a;, c, 01, 02, 61, 62, k, pk), initial ZAP-message z and ZAP-reply Z. 


Fig. 1. The 3-round concurrently sound rZK argument for MV in the cPK model. The 
value ki is chosen based on 77, 7 and k (see the proof of concurrent soundness) 


Theorem 1. If, for some positive r] and 7, there exist an ri-secure digital signa- 
ture scheme, a -secure commitment scheme and sub- exponentially strong ZAPs 
for all MV languages then there exists a 3-round concurrently sound resettable 
zero-knowledge argument system for any language L e MV in the cPK model. 


Proof. Consider the protocol in Figured] Completeness follows by inspection. 
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Concurrent Soundness. Assume by contradiction that the protocol is not con- 
currently sound; then there exists a malicious prover P* that in a concurrent 
attack has a non-negligible probability of making verifier V accept x for some 

x J 

We assume we know the session j* of the verifier in which the prover will 
succeed in cheating. This assumption will be later removed. In order to obtain 
a contradiction we show an algorithm A running in time o(2 k ) that breaks 
the jj-secure digital signature scheme SS used in the construction. Algorithm A 
receives a signature public key pk, obtained by running G on input l fc , has access 
to P* and to a signing oracle O for a public key pk and outputs a signature of 
a message for which the oracle had not been queried. 

We now describe algorithm A. On input challenge public key pk, A performs 
the set-up procedure and builds the public entry of the verifier as (pk, z) where 
2 is the output of algorithm ZG on input l k . Algorithm A starts the interaction 
with the prover P* and, for all sessions j constructs the message to be sent in the 
second round of the protocol by following the verifier’s algorithm and by resorting 
to the oracle O to compute signatures of messages moc, for messages m received 
from P*. At the end of session j*, since x / £ then, by the soundness of the ZAP 
(ZG,ZP,ZV), it must be the case that P* has exhibited commitments di,a2 
of two different messages a\ , <22 and commitments b \ , b 2 of two signatures 61 , 62 
such that, b\ is a signature of a\ and 62 is a signature of aa ■ Moreover, messages 
a\ and 02 have the value of the counter chosen by P* for the j*-th session as 
suffix. Then A in time O(P 0 LY(fci) • 2 kl ) breaks the secrecy of the commitments 
and obtains the two messages along with their corresponding signatures. Now, 
A has queried the oracle for public key pk once for each value of the counter 
(we remind the reader that the adversary P*, for each value of the counter, is 
allowed to run the verifier at most once) and thus A has not queried the oracle 
for at least one of a\ o c or aa o c. By picking k\ such that kj < k' n , we have that 
A runs in time o(2 fc ) and we have reached a contradiction. 

In our proof we assumed that A knows the value j*. If this is not the case that 
A can simply guess the value and the same analysis applies since this decreases 
only by a polynomial factor the probability of breaking the digital signature 
scheme. Moreover A can also try to break all the commitments of all sessions, 
since the running time will still be o( 2 fc ”). 

Resettable Zero Knowledge. Let V* be an (s, fj-resetting verifier. We next de- 
scribe a probabilistic polynomial-time algorithm S = S v that has black-box 
access to V* and whose output is computationally indistinguishable from the 
view of the interactions between P and V*. 

The simulator S receives from V* requests that can be described wlog by 
a quadruple (x,i,r,v), where x denotes the input instance for language L, i 
denotes the index of the public key with respect to which the interaction has 
to be simulated, r is the index of the random tape that must be used in the 
simulation, v is the index of the message that S must send (and, for our specific 
protocol, v = 1 or v = 3 ). We remark that the resetting adversary V* is allowed 
to reset the prover to any previous state and even request that a different random 
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tape has to be used (however, V* is not allowed to feed the prover with a random 
tape of its choice). 

Simulator S maintains several data structures which will be implicitly used 
in its description below and performs all the consistency checks requested by 
the protocol (for example, that the signatures received are valid). In addition, 
S also builds a table S(i,c) of signatures with entry (i,c) holding signatures of 
messages with suffix c computed with respect to the i-th public key. 

The interaction between V* and S consists of essentially four types of re- 
quests. Indeed, two rounds of the argument system are played by the prover and 
we distinguish two cases depending on whether or not the same round has been 
requested since the last rewind by the verifier. 

1. The request is (a:, i, r, 1) and it is the first such request since last rewind. 

In this case, S follows exactly the prover’s algorithm using the r-th random 
tape as source of randomness. 

2. The request is ( x , i, r, 1) and such request has already been presented to S 
by V* since last rewind. 

In this case, S re-plays the same message used in the previous round. 

3. The request is (a;, i, r, 3) and S has already received such a request since the 
last rewind. 

In this case, S re-plays the same message used in the previous round. 

4. The request is (a:, i,r, 3) and S has not received such a request since the last 
rewind. Let c be the value of the counter declared by V* in the message just 
preceding the request. We have two sub-cases: 

(a) S(i,c) contains two (or more) signatures. 

In this case S uses two signatures from S(i, c) as witness to compute the 
last message of the ZAP. 

(b) S(i,c) contains one signature. 

S has obtained the signature in the second round played by V* (the case 
in which ) S' (i, c) | = 0 and S has to play the third round cannot happen). 
In this case S needs to obtain a second signature with suffix c in order 
to be able to compute the last message of the ZAP. Thus, S starts a 
look-ahead for (i, c). More precisely, S rewinds V* to the state just after 
he has sent the first request (x, i, r, 1) (notice that since V* is a resetting 
adversary, there could be several such requests) and uses a new random 
string r' instead of r. S will repeat such a rewind strategy until a rewind 
ends by appending a second entry to (i,c). 

As we shall argue, the simulation will halt in expected polynomial-time 
as the number of pairs (i,c) (and thus the number of look-aheads) is 
bounded by s(ri)t(ri) which is a polynomial (we are considering by defi- 
nition an (s, ^-resetting verifier). 

The Views Are Indistinguishable. The first message played by S in each session 
has exactly the same distribution of the one played by the prover since S simply 
runs the prover’s algorithm. We stress that even though after each rewind S 
changes one randomness r g for a given je{l,..., s(n)}, V* is not aware of such 
an update since its view does not go back with respect to the last rewind. 
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The third round played by S has the following two differences with respect 
to the one played by the prover. 

1. The prover commits to junk bits (the 0 k strings) while the simulator com- 
mits to a pair of different messages with the same suffix, along with their 
signatures with respect to a given public key. By the computational hiding 
of the commitment scheme, V* does not distinguish the commitments of S 
from the commitments of the prover. More formally, if V* distinguishes with 
non-negligible probability the commitments of S from the commitment of 
P, then V* can be used to contradict the hiding of the commitment scheme. 

2. The prover uses y such that (a:, y) E B, L in order to compute the auxiliary 
witness for running ZP on input the auxiliary statement “r E A” . Instead, 
the simulator uses his knowledge of the different messages with c as suffix 
along with their signatures to compute the auxiliary witness for “r E A”. 
Both the prover and S follows the honest prover algorithm for the ZAP by 
running ZP on a good witness for the auxiliary statement. Therefore, an 
adversarial verifier V* that distinguishes the witness used by the simula- 
tor from the one used by an honest prover can be used to contradict the 
witness-indistinguishability of the ZAP. Note that in our implementation of 
the ZAP the prover uses as randomness a pseudorandom string of both z and 
the message sent by the verifier. Therefore, as remarked in [2TJ|22], this imple- 
mentation of ZAP preserves witness-indistinguishability even in case of reset 
attacks, i.e., the implemented ZAP is a resettable witness-indistinguishable 
proof system. 

The Simulation Ends in Polynomial Time. S has to compute two messages for 
each session. Note that for the first message, S always performs a straight-line 
simulation since the first round of a session is played by running the prover 
algorithm, and since no witness is needed, it can be computed by S without 
rewinding V* . 

The analysis is more complicated for the second message. First of all, observe 
that the simulator starts a new look-ahead procedure only after receiving a 
request ( x , i, r, 3). Such a request is immediately preceded by a message from V* 
containing one valid signature for a pair ( i , c) for which S(i, c) was empty before 
the request (for otherwise, no look-ahead procedure would be started since S has 
at least 2 valid signatures). In other words, the simulator starts a look-ahead 
procedure only after receiving a useful signature. However, observe that both the 
number of entries in the public file (and thus the number of possible values of 
i) and the number of possible values of the counter are bounded by the running 
time of the adversary V* that is assumed to be polynomially bounded. Next, we 
argue that the contribution of each entry to the expected work of the simulator 
is also polynomially bounded. Roughly speaking, the contribution of each pair 
( i , c) is equal to the probability that counter c appears in a session with public 
key pkj times the number of rewinds needed to have a new session with the same 
public key and the same value of the counter in which we ask for the signature of 
a different message. It is easy to see that this quantity is polynomially bounded. 
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4.2 Three-Round CZK Argument of Knowledge in the cPK Model 

In this section we present a three-round concurrently-sound concurrent zero- 
knowledge argument of knowledge in cPK for any language L £ AT V under stan- 
dard intractability assumptions. 

The argument of knowledge that we present is derived from the argument 
of membership of the previous section by replacing the ZAP with a 3 -round 
witness-indistinguishable proof system to prove a statement of the form “aV/ 3 ” 
where a is known at the beginning of the protocol while /3 is known only in 
the last round. Additionally, we need witness extraction with respect to a. An 
implementation of this primitive can be given by using a variation of the protocol 
presented in [ 25 ] (this is also used in [ 25 ]b 

To prove the properties of our construction, we assume the existence of sig- 
nature and commitment schemes secure with respect to polynomial-time ad- 
versaries, and the existence of the mentioned 3 -round witness-indistinguishable 
proof system of membership -k for any NP language (which can, in turn, be based 
on the existence of one-way permutations). We use this proof system as a black 
box and denote the messages computed in it as where wi\ is sent 

by the prover, wi^ is sent be the verifier and wi% is sent by the prover again. 
Note that in order to prove that i?I, for some NP language L, the message 
wi\ can be computed in polynomial time given only the length value \x\ (that 
is, neither x nor a witness for it is necessary). 

The Public File. Let k be the security parameter. The *-th entry of the public 
file F consists of a randomly generated public key pk with security parameter 
k for the secure signature scheme SS and of the first round of a two-round 
computationally-binding perfectly-hiding commitment scheme. 

Private Inputs. For the statements “ x £ L”, the private input of the prover 
consists of a witness y for x £ L. The private input of the verifier consists of the 
private key sk corresponding to the public key pk and a counter c. 

The Protocol. Suppose that the prover wants to prove that x £ L and that the 
verifier knows the private key sk of the i - th public key pk of the public file F. 

In the first round P randomly picks string m of length k, computes wi\ 
according to the proof system n, and sends the pair (to, 7t) to V. Then V in- 
crements c and uses the private key sk to compute a digital signature rh c of 
mo c, computes message wi-2 and sends the triplet (l c , rh c , vri-z) to P. In the 
last round P verifies that rh c is a valid signature of m o c with pk and computes 
the commitments of 0 fc . Then P computes message wiz according 

to proof system 7 r by using instance (a:, c, Si, a2, 61, 62, k, pk) and string y as the 
input and witness for 7r, respectively. P sends vx>'t 3 , dj . 0.2 . bi , 62 to V. Finally, V 
verifies that {wix,wi 2 ,wiz) is valid by running the verifier’s accepting predicate 
in proof system 7 r, using as input the instance (x, c, a -[ , 0.2 ,bi, 62 , k, pk). 
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Theorem 2. If there exist one-way permutations, then there exists a three- 
round concurrently- sound concurrent zero-knowledge argument of knowledge for 
AfV in the cPK model. 

The proof of Theorem [5] is omitted from this extended abstract. 


5 Conclusion 

In this paper we have presented a 3-round concurrently-sound resettable zero- 
knowledge argument system in the cPK model that improves the previous works 
of Micali and Reyzin m and Zhao et al. jTS] , The cPK model is only a slight 
variation of the BPK model, and we have shown that it can be used to go beyond 
the barrier of four rounds needed for concurrent soundness in the BPK model. Our 
result makes a big step for closing the gap between a public-key model that ad- 
mits three-round concurrently-sound resettable zero-knowledge arguments and 
the BPK model. Moreover, we have shown a 3-round concurrently-sound concur- 
rent zero-knowledge argument of knowledge in the cPK model under standard 
intractability assumptions. 
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